Access roles answer what a person may do in Tindre. They contain permission grants such as reading, writing, or administering a capability. A membership can carry several access roles; the effective permissions are the union of those grants.
Access role
Authorization in Tindre.
- Contains permission keys
- Assigned to memberships
- Deny-by-default for non-admins
- Managed in Administration
Responsibility Role
Accountability in the organization.
- Lives inside an Axis
- Has holders
- Owns and scopes governed content
- Managed in the responsibility map
Start from the job
Create or choose an access role for a recognizable set of actions.
Grant the minimum set
Add only the capabilities needed. The administrator exception has all access, while custom roles remain explicit and fail closed when a new permission appears.
Review before removing
Removing a grant can make routes and actions disappear. Check whether the person still owns Standards or reads an Agent’s conversations; ownership does not itself restore product access.
Test as a non-admin
Administrator sessions hide missing grants. Verify custom roles using a representative account and confirm both allowed actions and expected refusals.