Skip to main content

Configure your first RBAC Policy

Build your first role-based access control (RBAC) policy in the Permit.io dashboard, without code. This walkthrough is for new Permit users. You create an Admin role and a Document resource, give the Admin role permissions on documents, and assign the role to a user.

In RBAC, you give permissions to roles, and you assign roles to users. A user can perform an action on a resource when one of the user's roles has that permission. For example, an Admin role can create and delete documents, while a Viewer role can only read them. For more background, see What is RBAC.

Prerequisites​

  • A Permit.io account with a project and environment. Sign up at app.permit.io.
1

1. Create a role​

A role is a named set of permissions. It defines what a user with that role can do in your application.

  1. In the Permit dashboard, open Policy and select the Roles tab.
  2. Click Create a Role (or Add Role when roles already exist).
  3. In Name, enter Admin. Permit fills in the Key from the name. Your code uses the key to refer to the role.
  4. Optionally, enter a Description that explains what the role is for.
  5. Click Save.

The Admin role appears in the Roles list.

2

2. Create a resource and its actions​

A resource is a type of object in your application that needs access control, such as a file, a database record, or, here, a document. Actions are the operations users perform on a resource.

  1. In Policy, select the Resources tab.
  2. Click Create a Resource (or Add Resource when resources already exist).
  3. In Name, enter Document. Permit fills in the Key.
  4. In Actions, keep the default actions: create, read, update, and delete.
  5. Add a custom action for an operation specific to your application: type publish and press Enter.
  6. Click Save.

The Document resource appears in the Resources list.

3

3. Grant the Admin role permissions in the Policy Editor​

The Policy Editor is a grid of roles, resources, and actions. Each checked box allows one role to perform one action on one resource.

  1. In Policy, select the Policy Editor tab.
  2. Find the Admin role, and the Document resource under the role.
  3. Check the actions the Admin role can perform on documents. The video checks create, delete, and publish.
  4. Click Save Changes.

When you change the checked boxes and save, the policy changes. Your application code doesn't change.

4

4. Add a user and assign the role​

Users are the people or services that use your application. A user gets permissions through the roles you assign.

  1. Open Directory.
  2. Click Add user.
  3. In Key, enter a unique ID for the user, for example unique_id_12345. Your code passes this key to permit.check().
  4. In Email, enter sam@permit.io. Optionally, enter a first and last name.
  5. In Assigned Roles (labeled Top Level Access in some dashboard versions), select Admin.
  6. Click Save.

Verify the policy​

  1. Open Directory. The user sam@permit.io appears with the Admin role.
  2. Open Policy > Policy Editor. Under Admin > Document, the actions you checked are still checked after you reload the page.

The user sam@permit.io can perform the checked actions on documents. To confirm this with a permission check from code, continue to Run your first policy check.

What you built​

You configured an RBAC policy from its four parts: a role, a resource with actions, permissions that connect them, and a user with a role. The attribute-based and relationship-based policy models in Permit build on the same roles, resources, and actions.

What's next?

Next: connect your application with an API key and the SDK.

Contents

Edit this page

Need help?