Noxus authorization is permission-driven and split between:
- Workspace-level permissions — govern what a user can do inside a specific workspace.
- Organization-level permissions — control cross-workspace and tenant-wide administration.
Workspace-Level Permissions
These permissions are scoped to a workspace and stored as boolean flags on the user’s workspace role.
workspace_admin cascade behavior
workspace_admin is a superset of the other administration permissions. When a user or API key has workspace_admin, the authorization layer grants:
- Full integrations access (create, read, edit, delete) — equivalent to
integrations_edit plus create/delete.
- Full workspace users access (create, read, edit, delete) — equivalent to
users_edit plus users_delete plus create.
integrations_edit alone grants read and edit on integrations. users_edit alone grants read and edit on workspace members. users_delete alone grants delete on workspace members.
Organization-Level Permissions
These permissions control tenant-wide operations and are checked independently of workspace membership.
Role Scope
Workspace roles can be global or workspace-scoped:
- Global role (
is_global=true) — applies to every workspace the user belongs to.
- Workspace-scoped role — applies only to the specific workspace the role was created for.
Global roles are created from the Roles → Workspace → All workspaces view. Workspace-scoped roles are created for a specific workspace.
Admin Configuration
Role-to-permission mapping and global authorization policy should be managed from Settings → Roles by users with workspace_admin (for workspace roles) or org_admin (for organization roles).
Keep role definitions small and composable. Use the individual permission keys as the stable contract rather than building monolithic admin roles.
