RBAC

Role-Based Access Control for members, resources (permission keys), and roles. The same matrix applies to your web app (SDK) and Transcodes Auth — the backend is the authority. AI Agent (MCP) enforcement is Coming Soon.

Permission model

Each role has a matrix: resource key × CRUD action → level.

Actions (only these four): create · read · update · delete

When you add a resource in the desktop app, every role gets defaults: read = allow (1), create / update / delete = allow + step-up (2).

Built-in transcodes is seeded differently: read = 1, create / update = 2, delete = 0 (deny).

Authentication setup seeds built-in system (platform admin / MCP) and transcodes (every feature available in the Transcodes desktop app — project, auth cluster, members, roles, resources, permissions, billing, and other app operations). Both cannot be edited or deleted.

Desktop app setup

1. Open the Transcodes desktop app → your project → Authentication Kit Cluster → RBAC.
2. Resources — register keys your app uses (documents, billing, …). Keys: lowercase letters, digits, hyphen.
3. Roles — create roles and set the permission matrix per resource × action.
4. Members — assign each member a role.

Resource keys in code must match the desktop app exactly.

Web app (SDK)

Before a sensitive action, call step-up with the same resource and action strings:

const res = await transcodes.redirectToStepUp({
  resource: 'documents',
  action: 'delete',
});
const gate = res.payload[0];
const ok =
  res.success &&
  (gate?.decision === 'allow' ||
    (gate?.decision === 'stepup' && gate?.status === 'verified'));
if (ok) {
  // proceed
}

See Step-up Auth for the full redirect flow.

AI agents (MCP) — Coming Soon

Related