Loading...
Loading...
The RAG Starter Kit implements role-based access control (RBAC) with 18 distinct permissions across 6 resource types. Permissions are enforced at the API route level and checked against the user's role in the workspace.
Full control over the workspace including member management.
Permissions: All permissions
Manage members and workspace settings, but cannot delete the workspace.
Permissions: All except workspace deletion
Upload documents, manage conversations, and use chat features.
Permissions: Documents (CRUD), Chat, Sources
Read-only access to documents and chat history.
Permissions: Documents (read), Chat (read)
| Resource | Action | OWNER | ADMIN | EDITOR | VIEWER |
|---|---|---|---|---|---|
| workspace | view | ✓ | ✓ | ✓ | ✓ |
| update | ✓ | ✓ | ✗ | ✗ | |
| delete | ✓ | ✓ | ✗ | ✗ | |
| manage_members | ✓ | ✓ | ✗ | ✗ | |
| manage_settings | ✓ | ✓ | ✗ | ✗ | |
| documents | view | ✓ | ✓ | ✓ | ✓ |
| create | ✓ | ✓ | ✓ | ✗ | |
| update | ✓ | ✓ | ✓ | ✗ | |
| delete | ✓ | ✓ | ✓ | ✗ | |
| manage_ingestion | ✓ | ✓ | ✓ | ✗ | |
| chat | view | ✓ | ✓ | ✓ | ✓ |
| create | ✓ | ✓ | ✓ | ✗ | |
| manage_conversations | ✓ | ✓ | ✓ | ✗ | |
| sources | view | ✓ | ✓ | ✓ | ✓ |
| export | ✓ | ✓ | ✓ | ✗ | |
| api_keys | view | ✓ | ✓ | ✓ | ✓ |
| create | ✓ | ✓ | ✓ | ✗ | |
| revoke | ✓ | ✓ | ✓ | ✗ | |
| audit_logs | view | ✓ | ✓ | ✗ | ✓ |
Permission checks are implemented in src/lib/workspace/permissions.ts. Every API route that accesses workspace resources calls checkPermission()which verifies the user's role in the workspace against the required permission.
Example: To upload a document, the user must have documents:create permission. An EDITOR can upload, but a VIEWER receives a 403 Forbidden response.