Access Control
SteelEngine's policy-based roles, permissions, assignments, and effective-access model.
SteelEngine uses one policy-based access-control system across the dashboard, APIs, realtime collaboration, and platform MCP server. Access is expressed as roles made from catalog permissions and assignments that apply those roles to people or groups at a defined scope.
The access decision
For each protected operation, SteelEngine evaluates:
person or key owner
+ direct and group role assignments
+ role inheritance
+ organization or workspace scope
+ catalog permission for the requested action and target
+ explicit deny rules
+ plan entitlements
+ API-key scope cap, when a key is used
= allow or denyThe visible role name is never the authorization decision. A custom role works exactly like a seeded role because both resolve to catalog permissions.
Start here
- Roles and Permissions explains seeded roles, custom roles, inheritance, and assignments.
- Manage Access covers the People, Groups, Roles, and Activity tabs.
- How Effective Access Is Calculated explains scope, provenance, union, deny precedence, and key caps.
- Permission Catalog Reference lists permission families and stable keys.
- SteelEngine MCP explains how an MCP client's visible operations follow the caller's effective access.
Core terms
| Term | Meaning |
|---|---|
| Permission | A catalog action on a resource family, such as workflow:execute |
| Role | A named set of permissions and inherited roles |
| Assignment | A role bound to a person or group at organization or workspace scope |
| Effective access | The result after all applicable assignments and policy constraints are evaluated |
| Provenance | Why access exists: direct, via a group, inherited, or organization-wide |
| Key scope | An additional boundary placed on an API key; it never grants more than the owner has |
Permission groups and roles solve different problems. A group collects people and can receive role assignments. A role collects permissions and can be assigned to a person or group.