Authorization & Access Control
Status
Owner: Tech lead · Status: draft · Canonical source: flezi.app.api.backend/app/authz/matrix.py
Flezi Galaxy implements Scoped Role-Based Access Control (Scoped RBAC) conforming to SRS v1.1 §2.3.
User Roles
| Role | Scope & Permissions |
|---|---|
SYSTEM_ADMIN | Full administrative control across the entire platform. |
ORG_ADMIN | Organization-level administrator: manages workspaces, members, and billing. |
WORKSPACE_ADMIN | Manages workspace-level memberships and asset sharing. |
WORKSPACE_MEMBER | Standard user: chats, creates personal agents, uses shared assets. |
AI_BUILDER | Advanced member: manages agents, workflows, and AGT security policies. |
Scoping Enforcement
All data access is gated by require_permission(uc_id) and encapsulated in ScopeContext:
- Multi-tenant boundary: Users in Organization A can never see Organization B data.
- Resource ownership: Users cannot modify private agents belonging to other members.
Existing Controls
- 100% automated test coverage over 59 use case cells in
tests/authz/test_matrix.py. - Strict middleware enforcement on all API routes.
Evidence (Files & Configuration)
flezi.app.api.backend/app/authz/matrix.pyflezi.app.api.backend/app/authz/dependencies.py
Limitations & Roadmap
- Custom role definitions tailored to specific enterprise customer hierarchies.