Skip to main content
TM
TalentOS
Menu
DocsSecurity & ComplianceRBAC & Permissions

RBAC & Permissions

Role-Based Access Control with Attribute-Based checks. Fine-grained permissions per role, tenant, and module.

RBAC Model

TalentOS implements a hybrid RBAC + ABAC authorization model where access decisions consider:

Role — The user's assigned role (Owner, Admin, Manager, Coordinator, Finance, Viewer)
Tenant — Which tenant the user belongs to — enforced on every request
Resource Ownership — Whether the user owns or is assigned to the resource being accessed
Action Type — Read, Create, Update, Delete, Approve, Publish — each independently permissioned
Risk Level — High-risk actions (payouts, result publishing) require step-up authentication
API: Evaluate Policy
POST /v1/policies/evaluate
{
  "subject": { "user_id": "usr_...", "role": "manager", "tenant_id": "tnt_..." },
  "action": "approve_payout",
  "resource": { "type": "payout", "id": "pay_...", "amount": 50000 },
  "context": { "ip": "...", "device": "...", "mfa_verified": true }
}
// Returns: { "allowed": true, "obligations": ["log_audit", "notify_owner"] }

Permission Matrix

ModuleOwnerAdminManagerCoordinatorFinanceViewer
Talent ProfilesFullFullCRUDReadReadRead
BookingsFullFullCRUDRead/UpdateReadRead
ContractsFullFullCreate/ReadReadReadRead
PaymentsFullApproveRead—Full—
PayoutsApproveApprove——Create—
EventsFullFullCRUDCRUDReadRead
SettingsFullFull————
Bio WriterMFA Setup