Administrative roles

Administrative role bindings grant permissions within a scope. They do not replace runtime Cedar policy for tool access.

Inspect effective permissions

Use GET /v1/identity/me to check the authenticated actor and its effective permissions. A stored role binding associates a subject with a role and scope. The requested action must be permitted in that scope.

Manage bindings through the contract

Operation	Endpoint
List bindings	GET /v1/admin/role-bindings
Create a binding	POST /v1/admin/role-bindings
Preview a grant	POST /v1/admin/role-bindings/preview
Disable a binding	POST /v1/admin/role-bindings/{binding_id}/disable

Consult the Admin API for request fields and accepted roles. Preview the intended scope before granting access, then verify effective permissions using the affected identity.

Database-backed administration uses stored role bindings. Supplying a role name in a client header does not establish that grant.

Investigate a forbidden action

Confirm actor, scope, binding state, and required permission. Correct the narrow grant that is missing. Do not assume a role name alone proves permission over every environment or resource.

Implementation reference

Read the source contract.