Roles and RBAC

Shoehorn uses role-based access control (RBAC) powered by Cerbos to manage permissions. Roles determine what users can see and do in the platform.

Role Hierarchy

Tenant-Level Roles

Role	Description
tenant:admin	Full access to everything in the tenant
tenant:viewer	Read-only access to all resources

Resource-Specific Roles

Role	Permissions
Entity
entity:viewer	View and list entities
entity:editor	Create and update entities
entity:admin	Delete entities
Workflow
workflow:viewer	View and list workflows
workflow:executor	Create, execute, cancel own runs, retry own runs
workflow:admin	Delete workflows, cancel/retry any run
Mold (Template)
mold:viewer	View and list molds
mold:editor	Create and update own molds
mold:publisher	Publish molds
mold:admin	Delete molds
Operations
operations:viewer	View workloads and services
operations:operator	Update operations resources
operations:admin	Delete operations resources
Admin
admin:viewer	View audit logs and analytics
admin:operator	Manage users, integrations, dashboards
Marketplace
marketplace:viewer	Browse marketplace
marketplace:editor	Install and configure items

Role Inheritance

Higher roles include all permissions of lower roles:

entity:admin  ->  entity:editor  ->  entity:viewer
workflow:admin  ->  workflow:executor  ->  workflow:viewer
mold:admin  ->  mold:publisher  ->  mold:editor  ->  mold:viewer
tenant:admin  ->  all resource roles

Assigning Roles

Via the UI

1. Navigate to Admin > Users
2. Select a user
3. Click Add Role
4. Select the role
5. Click Save

Via the API

# Add a role to a user
curl -X POST https://shoehorn.example.com/api/v1/admin/users/<user-id>/roles \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"role": "entity:editor"}'

# Remove a role from a user
curl -X DELETE https://shoehorn.example.com/api/v1/admin/users/<user-id>/roles \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"role": "entity:editor"}'

Listing Role Assignments

curl https://shoehorn.example.com/api/v1/admin/roles \
  -H "Authorization: Bearer <token>"

Returns all role assignments with user details.

Ownership-Based Access

Some operations are restricted by ownership:

• Workflow cancel/retry: workflow:executor can only cancel or retry their own runs
• Mold update: mold:editor can only update molds they created
• workflow:admin and mold:admin can operate on any resource

How Authorization Works

1. User authenticates (OIDC session or API key)
2. Middleware extracts user roles from the database
3. For each request, Cerbos evaluates:
   • User’s roles
   • Target resource type and ID
   • Requested action
   • Tenant isolation (user’s tenant must match resource’s tenant)
4. Access is granted or denied

Authorization for API Keys

API keys use scope-based authorization instead of roles. See API Keys.

Fail-Closed Security

If a user has no roles assigned, all requests return 403 Forbidden. There are no implicit permissions.

RBAC Audit

When RBAC_AUDIT_ENABLED=true, all role changes are logged:

• Role assignments and removals
• Who made the change
• Timestamp
• Affected user

View audit logs in Admin > Audit Log.