Roles & permissions
Built-in and custom roles, the permission matrix, and overrides.
Access in TraceGuard is permission-based. A role is a named bundle of permissions; you assign roles to members.
The permission matrix
Permissions are fine-grained and follow a resource:action shape — for example
sboms:read, findings:write, vex:write. The permission matrix (under
Organization settings → Roles & permissions) shows every role against every
permission so you can see exactly what a role grants at a glance.
Custom roles
Beyond the built-in roles, you can create custom roles tailored to your organization — duplicate an existing role as a starting point, then adjust. Use overrides to grant or deny a specific permission on a role without rebuilding it from scratch.
Principle of least privilege
A principal (member, service account, or token) can never be granted more than the authority of whoever created it — grants are always intersected with the granter's own permissions, and enforced again at the database boundary.
Token scopes use the same permission IDs and support wildcards like
sboms:* or *:read. See
Authentication & tokens.