Permissions

The API enforces 72 permissions of the form product.resource.action: 13 in organisation scope and 59 in program scope (program 13, evidence 13, plans 14, review 10, progress 9). The catalog is pinned in api/app/auth/permissions.py (EXPECTED_PERMISSION_COUNT = 72), mirrored in web/lib/auth/permissions.ts and in the table below; web/scripts/check-permissions-sync.mjs compares the three by key, scope, order and count. Every route has exactly one permission or a documented public or authenticated rule; a missing permission answers 403 as problem+json with the key in permission.

Shape

product is one of org, program, evidence, plans, review, progress.
action comes from the closed set read, create, update, delete, manage, approve, link, sync, use, read_own, manage_owners.
Scope kind is org when the product segment is org, otherwise program. Org-scope permissions apply everywhere in the organisation; program-scope permissions apply inside one program.
Effective permissions are the union of direct and group role assignments; there are no deny rules.
.manage covers create, update, delete and the transitions to every status other than approved; .approve covers the /approve and /decision routes; .use starts agent runs or tool invocations.

Catalog

Organisation scope (`org`, 13)

Permission	Scope	Description
`org.settings.read`	`org`	Read organisation name, slug and settings
`org.settings.update`	`org`	Update organisation settings
`org.programs.read`	`org`	List the organisation’s programs
`org.programs.create`	`org`	Create a program
`org.programs.manage`	`org`	Rename, pause, complete or archive a program
`org.users.read`	`org`	List users of the organisation
`org.users.manage`	`org`	Invite, deactivate or update users
`org.groups.read`	`org`	List groups
`org.groups.manage`	`org`	Create, update or delete groups and their members
`org.roles.read`	`org`	List organisation role assignments
`org.roles.manage`	`org`	Assign or remove organisation roles other than owner
`org.roles.manage_owners`	`org`	Grant or revoke the organisation owner persona
`org.audit.read`	`org`	Read the organisation audit log

Program scope (`program`, 13)

Permission	Scope	Description
`program.settings.read`	`program`	Read program name, description, stage and status
`program.settings.update`	`program`	Update program settings and current stage
`program.members.read`	`program`	List members of the program
`program.members.manage`	`program`	Add or remove program members
`program.roles.read`	`program`	List program role assignments
`program.roles.manage`	`program`	Assign or remove program roles other than owner
`program.roles.manage_owners`	`program`	Grant or revoke the program owner persona
`program.connections.read`	`program`	List connections to external systems and their sync runs
`program.connections.manage`	`program`	Create, update or remove connections
`program.connections.sync`	`program`	Trigger a manual sync of a connection
`program.audit.read`	`program`	Read the program audit log
`program.agent_runs.read`	`program`	List agent runs and their events
`program.agent_runs.manage`	`program`	Cancel agent runs

Evidence (`evidence`, 13)

Permission	Scope	Description
`evidence.questions.read`	`program`	Read research questions
`evidence.questions.manage`	`program`	Create, update or delete research questions
`evidence.sources.read`	`program`	Read evidence sources
`evidence.sources.manage`	`program`	Register or update evidence sources
`evidence.sources.link`	`program`	Link a source to a question, finding or hypothesis
`evidence.findings.read`	`program`	Read findings
`evidence.findings.manage`	`program`	Record or update findings
`evidence.hypotheses.read`	`program`	Read hypotheses
`evidence.hypotheses.manage`	`program`	Propose or update hypotheses
`evidence.hypotheses.approve`	`program`	Accept or reject a hypothesis
`evidence.gaps.read`	`program`	Read knowledge gaps
`evidence.gaps.manage`	`program`	Address or dismiss knowledge gaps
`evidence.agents.use`	`program`	Start evidence agent runs (compare, gaps, hypotheses)

Plans (`plans`, 14)

Permission	Scope	Description
`plans.plans.read`	`program`	Read research plans
`plans.plans.manage`	`program`	Create, update or transition research plans
`plans.plans.approve`	`program`	Approve a research plan
`plans.protocols.read`	`program`	Read protocols
`plans.protocols.manage`	`program`	Draft, update or transition protocols
`plans.protocols.approve`	`program`	Approve a protocol
`plans.experiments.read`	`program`	Read experiment records
`plans.experiments.manage`	`program`	Create or update experiment records
`plans.reports.read`	`program`	Read research reports
`plans.reports.manage`	`program`	Draft, update or transition research reports
`plans.reports.approve`	`program`	Approve a research report
`plans.tools.read`	`program`	List approved tools and their invocations
`plans.tools.use`	`program`	Invoke an approved analytical or design tool
`plans.agents.use`	`program`	Start plans agent runs (draft protocol, draft report)

Review (`review`, 10)

Permission	Scope	Description
`review.sops.read`	`program`	Read standard operating procedures and document requirements
`review.sops.manage`	`program`	Draft, update or transition SOPs
`review.sops.approve`	`program`	Approve an SOP
`review.checks.read`	`program`	Read review checks
`review.findings.read`	`program`	Read review findings
`review.findings.manage`	`program`	Annotate review findings
`review.findings.approve`	`program`	Decide a review finding (accept, dismiss, resolve)
`review.deviations.read`	`program`	Read deviations
`review.deviations.manage`	`program`	Record or update deviations
`review.agents.use`	`program`	Start a review check (agent comparison against an SOP)

Progress (`progress`, 9)

Permission	Scope	Description
`progress.milestones.read`	`program`	Read milestones and the program overview
`progress.milestones.manage`	`program`	Create, update or delete milestones
`progress.dependencies.read`	`program`	Read milestone dependencies
`progress.dependencies.manage`	`program`	Create or delete milestone dependencies
`progress.open_items.read`	`program`	Read open items
`progress.open_items.manage`	`program`	Create or update open items
`progress.approvals.read`	`program`	Read approval requests
`progress.approvals.manage`	`program`	Request or withdraw approvals
`progress.approvals.approve`	`program`	Decide an approval request

Reading the table

evidence.hypotheses.approve (program) is the permission a person needs to accept or reject a hypothesis; org.roles.manage_owners (org) is the one permission that separates org_owner from org_admin. Which persona holds which key is on the personas page.

Source: api/app/auth/permissions.py, web/lib/auth/permissions.ts, web/scripts/check-permissions-sync.mjs, PRODUCT-CONTRACT.md

Permissions

Shape

Catalog

Organisation scope (org, 13)

Program scope (program, 13)

Evidence (evidence, 13)

Plans (plans, 14)

Review (review, 10)

Progress (progress, 9)