Michael Gaffney
1ac3660dca
* Docs: add domain model diagram * Docs: fix meta data in domain model pages * Docs: add Sessions to domain model
47 lines
1.1 KiB
Plaintext
47 lines
1.1 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Domain Model - Roles
|
|
sidebar_title: Roles
|
|
description: |-
|
|
The anatomy of a Boundary role
|
|
---
|
|
|
|
# Roles
|
|
|
|
A role is a collection of capabilities granted to any Principal the Role is assigned to.
|
|
A Role belongs to one and only one Scope.
|
|
A Role owns zero or more Direct Grants.
|
|
A Role can be assigned to zero or more Principals.
|
|
A Principal assigned a Role receives all capabilities granted by any Direct Grant owned by the Role.
|
|
A Role is deleted when the Scope it belongs to is deleted.
|
|
All Direct Grants owned by a Role are deleted when the Role is deleted.
|
|
The lifecycle of a Role is not tied to the lifecycle of any Principal.
|
|
|
|
```shell-session
|
|
+---------------------------------+
|
|
| Organization |
|
|
+----------------+----------------+
|
|
| Role 1 | Role 2 |
|
|
+----------------+----------------+
|
|
```
|
|
|
|
## Attributes
|
|
|
|
### ID
|
|
|
|
A role is prefixed with `r_` followed by ten digits.
|
|
|
|
Example: `r_0123456789`
|
|
|
|
### Users
|
|
|
|
A role can have zero or more users associated with it.
|
|
|
|
### Groups
|
|
|
|
A role can have zero or more groups associated with it.
|
|
|
|
### Grants
|
|
|
|
A role can have zero or more grants associated with it.
|