Roles and Permissions (RBAC & ABAC)

Omnismith features a multi-tiered security system combining Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) across three role configuration tabs:

1. Basic Settings Tab (RBAC): Controls module permissions and administrative actions.
2. Resources Tab (RBAC): Sets template and attribute access levels (Full, Edit, View Only, Deny).
3. Scopes Tab (ABAC / Row-Level Security): Restricts entity visibility conditionally based on attribute values.

---

1. Module & Action Permissions (Basic Tab)

In the Basic settings tab of a role, you enable or disable permissions across core feature areas:

• Role Management: Create, edit, or delete project roles.
• Project Management: Modify project settings and manage member invites.
• Data Modeling: Create and modify Templates and Attributes.
• Entity Management: Create, edit, export, or delete entity records.
• Dashboards & Automations: Build dashboards and configure notification rules.
• Access Tokens & Billing: Manage API keys and subscription plans.

---

2. Resource-Level Restrictions (Resources Tab)

In the Resources tab, you can override default permissions for specific data structures:

Restriction Target	Access Level Options	Security Effect
Template Restriction	Full, Edit, View Only, Deny	Controls access to all entities instantiated under that specific template.
Attribute Restriction	Full, Edit, View Only, Deny	Hides or restricts editing of specific attributes across entity forms and API responses.

Access Levels Explained:

• Deny: The template or attribute is completely hidden and inaccessible to users with this role.
• View Only: Users can read and filter entity data, but cannot create or edit records.
• Edit: Users can create and edit entity records, but cannot delete schemas or templates.
• Full: Unrestricted administrative access for that specific resource.

---

3. Conditional Entity Scopes (Scopes Tab - Row-Level Security)

The Scopes tab provides Attribute-Based Access Control (ABAC) to enforce row-level security.

You can define conditional scope rules per template so users assigned to this role can only view or edit entities that match specific criteria (e.g. Only entities where Department = Sales or Status = Active).

Scope Configuration:

1. Select a Target Template.
2. Add Scope Conditions using attribute operators (Equals, Not Equals, In, Contains, Is Empty).
3. Combine multiple conditions to enforce strict row isolation.

---

💡 Developer Architecture Note

[!NOTE] Policy Enforcement & Row-Level Filtering: Permission checks occur at both the Nginx/API route level and the database query layer.

• Restricted attributes are stripped from API response payloads.
• Entity Scope conditions append dynamic WHERE clauses directly to SQL queries, ensuring non-matching rows are never returned to unauthorized clients.

---

Next Steps

[!TIP]

• Assign roles to team members in Projects & Members.
• Create scoped API keys in Access Tokens.