Permissions

Permissions decide what each user can do in the Rule Repository: create rules, make versions live, approve, delete, run tests, use the AI features. They are also how you shape its decision workflow to your organization: who may only write and request approval, who may approve or decline, and who may put a version into production or take it offline. RR has no roles and no user directory. On every request, your application hands RR the current user's set of permissions in the configuration; RR checks the request against it before doing any work, and its interface shows only what the set allows.

You need to set them because the default is safe but useless for writers: a configuration that sets nothing is view only. And because only your application knows who your users are and what their job allows, mapping your roles to RR's permissions is your decision.

What Everyone Can See

Every user who reaches RR sees the Sources, Source Versions, Rules and Rule Versions grids and the dialogs they open, including comparing versions, copying definitions and reading source fields. These four have no view permission. Everything else (drafts, tests, live evaluations, user activity, notes) has a view permission of its own, and its tab, buttons, counts and links disappear without it.

If some users must not see rules at all, keep them out of RR entirely with your application's own authorization on the RR page and endpoint.

Giving RR the Set

Two properties of Configuration describe it:

`AccessMode`	`ActionList` holds	Result
`ViewOnly` (the default)	ignored	No permissions: the four core grids, read only.
`AllowAllExcept`	the permissions to withhold	Every permission except those listed, and except everything that requires one of them.
`AllowOnly`	the permissions to grant	Exactly those listed. The list must be complete (below).

using CodeEffects.Rule.Common.Models;
using CodeEffects.Rule.Repository;

// A reviewer: sees everything, writes nothing but notes
var reviewer = new Configuration
{
	CurrentUserId = userId,
	AccessMode = ActionPermissionMode.AllowOnly,
	ActionList = new HashSet<ActionPermissionType>
	{
		ActionPermissionType.DraftView, ActionPermissionType.TestView, ActionPermissionType.EvaluationView,
		ActionPermissionType.ActivityView, ActionPermissionType.NoteView, ActionPermissionType.NoteCreate
	}
};

// A rule manager: everything except deleting and reading other people's AI conversations
var manager = new Configuration
{
	CurrentUserId = userId,
	AccessMode = ActionPermissionMode.AllowAllExcept,
	ActionList = new HashSet<ActionPermissionType>
	{
		ActionPermissionType.SourceDelete, ActionPermissionType.SourceVersionDelete,
		ActionPermissionType.RuleDelete, ActionPermissionType.RuleVersionDelete,
		ActionPermissionType.AiConversationViewAll
	}
};

Watch AllowAllExcept. It grants whatever it does not list, including permissions added in future releases and including deleting. List every permission a role must not have.

Combining roles is a union. A user in two roles gets both sets; because no permission forbids another, the union of two complete sets is always complete.

Your application can also implement IRepositoryConfiguration and answer CanPerform(action) from its own authorization service. See The Configuration.

Every Permission

The numbers are permanent; store either the names or the numbers.

#	Permission	Allows	Requires
10	`SourceUpdateDetails`	Changing a source object's name and description
11	`SourceDelete`	Deleting a source object
20	`SourceVersionUpdateDetails`	Changing a source version's name and description
21	`SourceVersionGoLive`	Making a source version live
22	`SourceVersionTakeOffline`	Taking a source version offline (choosing a replacement also needs 21)
23	`SourceVersionDelete`	Deleting a source version
30	`RuleCreate`	Creating rules
31	`RuleUpdateDetails`	Changing a rule's name and description
32	`RuleDelete`	Deleting a rule
40	`RuleVersionCreate`	Creating rule versions (New Rule Version, Clone)
41	`RuleVersionUpdateDetails`	Changing a rule version's name and description
42	`RuleVersionGoLive`	Making a rule version live, Save & Go Live
43	`RuleVersionTakeOffline`	Taking a rule version offline (choosing a replacement also needs 42)
44	`RuleVersionRequestApproval`	Requesting approval. No effect for a user who has 42
45	`RuleVersionApproveAndDecline`	Approve, Decline, Revoke Approval, Approve & Go Live	42
46	`RuleVersionDelete`	Deleting a rule version
50	`DraftView`	The Drafts grid and every way into drafts
51	`DraftCreate`	Creating drafts	50
52	`DraftUpdate`	Saving a draft again	50
53	`DraftConvert`	Turning a draft into a rule or a version	50, and 30 or 40
54	`DraftDelete`	Deleting a draft	50
60	`TestView`	The Tests grid, saved tests, value templates
61	`TestRun`	Running a test
62	`TestCreate`	Saving a new test	60, 61
63	`TestUpdate`	Saving a test again	60
64	`TestDelete`	Deleting a test	60
65	`TestRunBatch`	Running many saved tests at once	60, 61
66	`TestRunProductionCalls`	Running tests that call a real production method; without it a batch skips them and a single run is refused	61
70	`ValueTemplateCreate`	Saving value templates	60
71	`ValueTemplateUpdate`	Changing value templates	60
72	`ValueTemplateDelete`	Deleting value templates	60
80	`EvaluationView`	The Live Evaluations grid and every way into recorded evaluations
81	`EvaluationSaveAsTest`	Saving a recorded evaluation as a test (copies production data into a test)	80, 62
90	`ActivityView`	The User Activity grid and every way into the history
100	`NoteView`	Reading internal notes
101	`NoteCreate`	Adding notes	100
102	`NoteDelete`	Deleting any note, whoever wrote it	100
110	`AiAssistantUse`	The AI Assistant (also needs at least one AI model in the configuration)
111	`AiRuleEditorUse`	The AI Rule Editor tab (also needs a model)
112	`AiConversationViewAll`	Reading every user's AI conversations and attachments, and the Usage tab. A privacy decision: give it to administrators only	110

Creating source objects and source versions is not a permission: only your application does that, through source synchronization.

Complete Sets

Some permissions require others: DraftUpdate is useless without DraftView. How RR applies this depends on the mode:

AllowAllExcept completes the set itself: withholding DraftView also withholds every draft permission. Never an error.
AllowOnly and your own CanPerform must name a complete set. A permission granted without one it requires is a configuration error, and every request fails with CE10218 until it is fixed; the message lists every problem.

Test each role's set in your unit tests:

IList<string> problems = Context.ValidatePermissions(reviewer);
// empty when the set is complete; otherwise one sentence per problem,
// such as "DraftUpdate (52) requires DraftView (50)."

Rules No Permission Overrides

Only people make versions live, take them offline, approve, decline or delete. An AI agent (on its own or acting for a person) and a service never get permissions 11, 21, 22, 23, 32, 42, 43, 45, 46, 54 and 64, whatever you grant. Their saves always request approval. See Users and the Acting User.
Nobody approves their own request. A person cannot approve a version for which they requested approval themselves (CE10221). A request their own AI agent made on their behalf they may approve.
A version waiting for approval cannot go live until an approver approves it. See Live Versions and Approvals.

What Users See

A grid without its view permission is hidden, with its tab, row icons, count columns, related links and charts.
An action without its permission is shown but turned off, with the hint "You do not have permission to do this."
A changed set applies on the next page load. If the server refuses a request because the set changed meanwhile, the refusal carries the new set and the page applies it at once.
A refused request reaches your endpoint as a RepositoryPermissionException (CE10219): log it as a warning and return its ResponseJson, which the user sees as a warning. See The Server Endpoint.

Typical Roles

These are examples to adapt, not presets:

Role	Mode	List
Viewer	`ViewOnly`
Reviewer	`AllowOnly`	50, 60, 80, 90, 100, 101
Author	`AllowOnly`	30, 31, 40, 41, 44, 50-54, 60-65, 70-71, 90, 100, 101, and 110, 111 if you offer AI
Tester	`AllowOnly`	60-66, 70-72, 80, 81, 90, 100, 101
Publisher	`AllowOnly`	the author's list plus 42, 43, 45
Administrator	`AllowAllExcept`	(nothing, or 112 if administrators should not read others' AI conversations)

Ask on Stack Overflow - Yes, it's still active
Ask in GitHub Discussions

p102

l107

l097 --