6.2.2.22 MoonitoringRoleAccessControl
6.2.2.22.1 Purpose¶
A named bundle of platform capabilities for Moonitoring users, ordered by priority like organization roles.
6.2.2.22.2 Questions it answers¶
- What can a holder of this platform role do?
- Which roles may a Moonitoring user assign to others?
6.2.2.22.3 Fields¶
| Field | Type | Cardinality | Description |
|---|---|---|---|
id |
string (uuid) |
1..1 |
Key. |
name |
string |
1..1 |
Unique. |
capabilities |
MoonitoringCapabilityEnum | 0..* |
|
priority |
integer |
1..1 |
Higher value = higher priority = higher permissions; also used for ordering. A staff member grants, revokes or edits a role, or adds a capability to it, only if their own role outranks it by priority and holds every capability in it: nobody grants more than they have. Nobody acts on themselves: a staff member cannot grant, revoke or edit a role they hold, nor change their own membership; the operation answers 403. |
system_version |
SystemVersion | 1..1 |
|
key |
MoonitoringPredefinedRoleEnum | 0..1 |
Unique. The stable key of a predefined role; empty for a role staff created. |
created_at |
datetime |
1..1 |
|
updated_at |
datetime |
1..1 |
6.2.2.22.4 Relationships¶
Referenced by
Uses types
MoonitoringCapabilityEnum, SystemVersion, MoonitoringPredefinedRoleEnum
6.2.2.22.5 Rules & constraints¶
- Roles that can be given to Moonitoring users. The predefined ones (MoonitoringPredefinedRoleEnum) each have a stable key and an explicit list of capabilities.
- Administrators has the highest priority; every other predefined role ranks below it.
- Administrators has priority 1000 and every other predefined staff role 500, so no staff role but Administrators outranks another by priority alone: among the other roles nobody grants, edits or revokes.
- The access system creates the predefined roles with the capabilities of MoonitoringPredefinedRoleEnum when they are missing and never overwrites them.