FS26
Ctrl K
Phase 19 · Lesson 03

RBAC Roles and Permission Matrix

≈ 2 min core reading · 188 source/companion words
Learning contract

What you should be able to do after this

  • Explain RBAC Roles and Permission Matrix without relying on framework buzzwords.
  • Connect the lesson to the phase outcome: Enforce resource ownership, workspace membership, roles, and permissions on the API with server-side policies.
  • Reproduce the relevant behavior and verify it with evidence.
  • Diagnose at least one representative failure instead of guessing.
Figure 19.3 — TaskFlow boundary map
verified identity
resource lookup
membership
role/permission policy
allowed/denied use case
audit/error
This lesson belongs to Phase 19. Keep the full request/data path visible even when today's code changes only one box.
Instructor workflow: predict first → implement the smallest slice → run it → inspect evidence → break one assumption → diagnose → explain it back. Do not copy the whole code block before understanding the first failing boundary.

RBAC, Roles & Permission Matrix Map workspace roles to explicit operations without scattering role checks

Phase 19 - Authorization, Ownership, RBAC & Permissions Volume 05 - Authentication & Security

Architecture milestone

Membership role

v

Permission set

v

Coarse capability

Phase 19 transforms verified identity into contextual, server-side authorization decisions.

Role is a compact label; permission is the operation TaskFlow already has workspace MembershipRole values OWNER, ADMIN, and MEMBER. Phase 19 maps those roles to explicit permission names so controllers and services reason about actions rather than scattered if(role===...).

Operation OWNER ADMIN MEMBER

Read workspace/projects/tasks Yes Yes Yes

Create task Yes Yes Yes

Update any task Yes Yes No

Update assigned task Yes Yes Yes

Delete task Yes Yes No

Manage members Yes Yes No

Manage workspace settings Yes No No

export enum Permission { TASK_READ = 'task.read', TASK_CREATE = 'task.create', TASK_UPDATE_ANY = 'task.update.any', TASK_UPDATE_ASSIGNED = 'task.update.assigned', TASK_DELETE = 'task.delete', }

Do not put every permission in the JWT

Workspace roles can differ per workspace and change while a token is still valid. TaskFlow loads current application authorization data from PostgreSQL instead of treating stale token claims as the whole policy.

Executable lesson studio · authorization

Now turn the explanation into engineering skill.

Authorization decides what an authenticated identity may do to a specific resource. UI hiding is never a substitute for server-side enforcement.

By the end, you should be able to

  • Explain RBAC Roles and Permission Matrix in terms of concrete inputs, ownership, outputs, and evidence.
  • Implement or reproduce the smallest TaskFlow slice that demonstrates this authorization concept.
  • Diagnose one representative authorization failure using observable evidence instead of trial-and-error.
Figure 19.3B — Mental model
trusted identity
requested action
resource scope
policy decision
allow/deny
Read left-to-right while implementing. When debugging, walk right-to-left until the first observed fact differs from your prediction.
Code-along sequence

One coherent change at a time

  1. 01

    Restate the goal of “RBAC Roles and Permission Matrix” as one observable behavior. Write the success signal before touching code.

  2. 02

    Trace the boundary map: trusted identity → requested action → resource scope → policy decision → allow/deny. Mark the one boundary this lesson changes.

  3. 03

    Inspect the current repository state and record the exact files, route, table, or runtime involved. Avoid creating an abstraction before you can name the existing owner.

  4. 04

    Implement the smallest vertical slice. Add one coherent change, run the narrowest verification command, and read the output before continuing.

  5. 05

    Connect the slice to TaskFlow’s phase artifact: Permission model + guards/policies protecting TaskFlow workspace/task actions with deliberate 401/403/404 semantics.. Verify behavior from the outside as a user or API client would.

  6. 06

    Create one controlled failure that is safe to reproduce. Predict the symptom first, capture evidence, locate the earliest broken boundary, then fix only that cause.

  7. 07

    Close the reference and rebuild or explain the core change from memory. Record what you would monitor or test before trusting the same change in production.

tsRole and resource scope are separate questions
const canEdit =
  user.role === "ADMIN" ||
  (user.role === "MEMBER" && task.ownerId === user.id);

if (!canEdit) throw new ForbiddenException();

Do not copy this as a finished answer. Predict what each boundary does, type the smallest useful slice, run it, then compare the result with your prediction.

Verification

Prove the happy path

  1. Run the narrowest relevant command or request and require a clean exit/status.
  2. Inspect the boundary-specific evidence: terminal output, Network panel, database row/query plan, test report, container health, or deployment logs.
  3. Repeat the behavior once after the change so a one-off cached or stale result cannot masquerade as success.
Break it on purpose

Build debugging memory

  1. Checking membership after performing the mutation
  2. Change one assumption in the authorization example—identity, input, configuration, ordering, connectivity, or state—and predict the exact symptom before running it.
SymptomInvestigation path
User sees 403 unexpectedly

Trace verified identity, role, resource owner/workspace, and policy inputs separately.

UI hides action but API allows it

Add server-side resource authorization; UI visibility is only experience, never enforcement.

Closed-reference challenge

Can you transfer the idea?

Without copying the final source, create a second small scenario that applies “RBAC Roles and Permission Matrix” to a different TaskFlow resource or input. Write the acceptance criteria first, implement it, and provide the evidence that each criterion is satisfied.

Explain-back

Answer these without reopening the solution

  1. What problem does RBAC Roles and Permission Matrix solve in TaskFlow, and what would be observably wrong without it?
  2. Which part of the authorization boundary owns the decision, and which neighboring layer must not own it?
  3. What evidence proves the happy path instead of merely suggesting it worked?
  4. Name one realistic failure or abuse case and the first place you would inspect.
  5. If requirements doubled tomorrow, which part of this design should stay stable and which part is allowed to change?
Lesson studio

Turn the reading into skill

01

Do it

Load membership for the relevant workspace and treat it as authorization evidence.

Use the smallest change that demonstrates this lesson. Stop after it works and capture evidence.
02

Break it safely

Checking membership after performing the mutation

Predict the symptom before causing the failure. Then locate the earliest boundary where reality diverges from expectation.
03

Explain it back

Why does this responsibility live here, what input does it trust, what output proves success, and what would go wrong if another layer owned it?

If your explanation is vague, repeat the boundary trace before moving on.
Exit ticket

Before marking complete

Close the reference. Reproduce the core idea from memory or explain the exact request/data flow aloud. Then check your diff or notes for accidental shortcuts that bypass validation, authorization, error handling, or verification earned in earlier phases.

← Link Supabase Identity to TaskFlow UserNestJS Permission Metadata and Guards →