Identity & RBAC

How modules receive caller identity and enforce permissions.

ModuleActor

ModuleContext.actor includes identityPlane, optional userId / role, and permissionKeys.

  • Lifecycle hooks — service actor (no end-user)
  • Artifact API — tenant session actor from withTenantAuth
  • Admin UI slots — ModuleRuntimeProvider exposes role/permissions to client slot hosts

Tenant roles

OWNER, ADMIN, MANAGER, STAFF, VIEWER — declare granular permissions[] in the manifest and enforce on every mutating API route.