OPERATIONS O3 — Production RBAC

Status: COMPLETE (custom roles + commercial defaults)

Date: 2026-08-06

Model

Single source of truth: src/lib/rbac.ts + P3 tenancy (OrganizationMember + server scopes).

Default roles

| Role | Intent |

|------|--------|

| OWNER | Full organization authority |

| ADMIN | Operational admin — restart/announce/config/staff invite — no license.manage / servers.manage / staff.manage / config.high_impact |

| MODERATOR | Player moderation + AC review |

| VIEWER | Read-only operational access |

Custom roles

OrganizationCustomRole + OrganizationMember.customRoleId.

Owners define explicit permission lists. Non-owners cannot delegate NON_DELEGATABLE permissions.

Aliases

configuration.* ↔ config.*, anticheat.* ↔ detections.*/modules.*, server.change_map ↔ server.map, players.unban ↔ punishments.revoke.

Server scope

Unchanged: allServers or OrganizationMemberServerScope.

Customer denial copy

permissionDeniedMessage() — never “not allowlisted”.

APIs

• GET/POST /api/organizations/roles
• PATCH/DELETE /api/organizations/roles/[id]
• Staff PATCH: customRoleId, status (active/suspended)
• Invites: staff.invite sufficient