6.13.2.3 OrganizationRoleCapabilityEnum

6.13.2.3.1 Purpose

The catalog of permissions that organization roles grant. Values are defined in code; each one allows an action of a system inside an Organization.

6.13.2.3.2 Values

Value	Risk	Description
moochat.moochat.access	read	Use Moochat, which draws only on data the user's other capabilities let them read.
farm.animals.read	read	See animals: identifiers, type, sex, breed, ownership (see Animal).
farm.animals.update	write	Register animals and edit that data.
farm.animal_groups.read	read	See groups and their members (see AnimalGroup, AnimalGroupMembership).
farm.animal_groups.manage_members	write	Add animals to groups and remove them (see AnimalGroupMembership).
access.organization_delegations.manage	admin	Create, change and revoke delegations from this Organization to another, renounce those it received (see OrganizationDelegationMembership), and create the share codes that name it.
access.organization.update	admin	Edit the Organization's profile: name, fiscal identifier, telephone (see Organization). The transfer of ownership also checks it and is the owner's only (Organization.owner); the cooperative link and erasure requests have their own capabilities, access.cooperative_links.manage and farm.erasure_requests.request.
access.members.read	read	See the Organization's members, their roles and its delegations.
access.members.manage	admin	Add and remove members, assign and revoke their roles, direct or delegated (see OrganizationAccessControlMembership).
farm.ownerships.transfer	admin	Transfer an animal or a group to another Organization (see Ownership); it changes who can access it.
farm.animal_records.read	read	See the observations, events and periods of animals and groups (see CanonicalObservation, CanonicalEvent, CanonicalPeriod).
farm.animal_events.record	write	Record events as an operator: entry, exit, service, pregnancy check, parturition, abortion, dry-off, heat, breeding status (see CanonicalEvent).
farm.animal_diagnoses.record	write	Record diagnosis, health check and treatment events (see CanonicalEvent: DiagnosisEvent, HealthCheckEvent, TreatmentEvent).
farm.official_submissions.submit	write	Validate and send data to official bodies, e.g. milk recording (see OfficialSubmission). The functional control is not a concept of the model, only one export format.
farm.animal_groups.manage	write	Create, edit and archive groups (see AnimalGroup).
farm.sources.manage	admin	Connect and disconnect the Organization's channels and devices (see SourceChannel, Device, DeviceAssignment), and set up the integrations of its sync clients (see SourceFeed).
farm.ingestion.read	read	See what the Organization's sources sent and what failed to process (see SourceProducerEntity, RawMetadata, IngestionSkip).
access.cooperative_constraints.read	read	See the constraints of a cooperative (see CooperativeConstraint): its own in a Cooperative, those imposed on it in a Farm.
access.cooperative_constraints.manage	admin	Create, edit and delete the constraints a Cooperative imposes on its farms; it has no effect in a Farm.
farm.animal_records.edit_own	write	Edit or cancel observations and events that entered through the Organization's own feeds (our app, uploaded files), and remove uploaded files. Never data from labs, sensors, management software or registries (see SourceFeed).
farm.data_issues.read	read	See the DataIssues of the Organization's feeds (see DataIssue).
farm.sync_clients.read	read	See the Organization's sync clients, their version and last sync (see SyncClient, ReleaseInstallation).
farm.sync_clients.manage	admin	Connect a computer to the Organization as a sync client, manage its clients (register, issue enrolment codes, retire) and set their sync schedules (see SyncClient, SyncSchedule); the sync client offers to connect a computer only to the farms where the person holds it. Every enrolment creates a ServiceAccount in the Organization.
farm.models.use	read	Call the model APIs and see their outputs, for the models the Organization is entitled to (see Entitlement).
farm.sync_runs.write	write	Act as a farm sync client: open, commit and fail sync runs, upload raw files, report digests and the installation (see SyncRun, SyncDigest, SyncClient). Held, together with farm.sync_clients.read, only by the system role Sync Client (sync_client), given to the ServiceAccount a farm sync client becomes at enrolment: priority below every other role, never delegated, never assigned to a Person, and no role of a Person holds it.
access.webhooks.manage	admin	Register, change and delete the Organization's webhook subscriptions, rotate their secrets and redeliver events.
farm.farm_configurations.manage	write	Record the farm's configuration over time, such as its milking system (see FarmConfiguration).
grant.checks.run	read	Ask whether the Organization meets the criteria of a funding call, with the feature grant.checks (see Entitlement).
grant.documents.manage	write	Upload, read and delete the Organization's documents for funding applications.
moochat.connectors.manage	admin	Connect and revoke the Organization's external systems for agent tools (see AgentConnectorInstance); future work, with the connectors.
access.groups.read	read	See the Organization's user groups, their members and their roles (see UserGroup).
access.groups.manage	admin	Create and archive user groups, change their members and give or revoke their roles, within the priority rule (OrganizationRoleAccessControl.priority).
access.organization.close	admin	Ask for the closure of the Organization and cancel it during the grace period (see OrganizationClosure); held by the owner's role only.
access.cooperative_links.manage	admin	Ask a cooperative to link the farm, accept or reject the requests of farms in a Cooperative, and end the link (see Farm.cooperative); was part of access.organization.update.
farm.erasure_requests.request	admin	Ask for the erasure of the Organization's data and see its requests (see ErasureRequest); was part of access.organization.update.
grant.call_actions.manage	write	Save and dismiss funding calls for the Organization, and see the calls it saved or dismissed.
access.cooperative_members.read	read	See the farms linked to a Cooperative and the membership data they share with it without a delegation (see Farm.cooperative): name, owner contact, member since, link status, number of animals, when data last arrived and whether the farm meets the cooperative's constraints (confirmed 2026-10-31). It has no effect in a Farm. Held by the predefined Owner and Manager, so a cooperative sees its member farms.

6.13.2.3.3 Relationships

Used by

• OrganizationRoleAccessControl.capabilities

6.13.2.3.4 Rules & constraints

• Capability catalog, defined in code: each value is a granular permission for an action of a system.
• Names are <system>.<resource>.<action>: the prefix is the system that owns the resource, e.g. access for Organizations, their members and delegations, farm for the farm data, its sources and its sync (ingestion merged into farm). A new system adds its own prefix; a role may bundle capabilities of several systems.
• Roles grant capabilities within an Organization; AnimalGroup is a resource.
• Each system publishes its capability catalog from its code; access validates a role's capabilities against the union of the catalogs and rejects a name no system publishes. The prefix follows the system that owns the resource, whichever interface shows the screen.
• Every capability declares its risk: read only reads, write changes the Organization's data, admin changes who can act in the Organization, where its data goes or whether it exists. A role that holds an admin capability is never delegated (OrganizationDelegationMembership.role), never given by a join link (OrganizationJoinLink.role) and never held by a ServiceAccount (ServiceAccount.organization), and every write that needs one asks for a fresh sign-in (User); a read never does.

Open questions

Resource scopes, e.g. milk quality only for a Quality reader role, and cooperative delegation.