A Role is a group of Policies that can be assigned to someone.
They allow you to create flexible and hierarchical permissions.
A Role can have two fields:
Name
This is the name of the Role. It must have the role::
prefix.
Policies
A policy is an authorization rule that a user has over a specific
resource. You can describe a certain Policy such as, "Allow Alice to
read and update the properties of any given Thing in Category
"my_category." Policies determine the level of access, which is then
given out in the form of an Access Token. Each Policy has the following
fields:
Resource: The entities or entity this Policy should rule.
Effect: Indicates if the Policy will grant access to a resource
or will deny it. Effect can be allow or
deny.
Deny Policies always
prevail over Allow Policies: If you have both
Allow and Deny Policies over a specific resource, the
subject will not be able to access it.
Action: Indicates what a Policy can -- or cannot -- do with a
resource. It can be one or a combination of these:
Create: Permission to add new resources.
Read: Permission to read or retrieve the
resource.
Update: Permission to modify the resource.
Delete: Permission to delete the resource
Root Role
A role root has already been created by default. This role can create, read, update
and delete any resource of the account.
Note: This role cannot
be modified.
Figure 1.
Create a New Role
In this example, you will create a role for guest users to enable them to manage
Things in a public guests Category and
invoke the guest-function Function. After naming the role, you will
add the Policies to the new Role:
Before adding the new Policies, delete the policy that appears by
default.
Add Policy to grant access to the Category
guests.
Policy Resource:
Section: AnythingDB
Resource Type: Categories
Category Name: guests
Note: Policy Resource field
is automatically populated.
Policy Effect: enable to allow.
Action: read, create, update and delete
Add Policy to grant access to invoke the Function
guest-function.
Policy Resource:
Section: Functions
Resource Type: Sync Invoke Functions
Function Name: guest-function
Policy Effect: enable to allow.
Action: read, create, update and deleteFigure 2.
Create a policy to deny access to the Authorization section, so the users with
this role won't be able to see other users' details, modify roles and policies
or manage secrets.