access/roles.yaml and grants.yaml
Every key of config/access/roles.yaml (staff roles and their permissions) and config/access/grants.yaml (roles granted to staff groups under a scope).
config/access/roles.yaml defines staff roles and config/access/grants.yaml grants them to staff groups, optionally scoped to sites, types, locales, tags, states or ownership. Scope is enforced in every query, not filtered afterwards.
grants:
- group: editors
role: editor
scope:
site: [wyndmouth] engine-dmo access matrix prints every active user’s effective permissions, and engine-dmo user grant-explain says why a user may or may not do something. schema apply refuses a change that would leave nobody able to manage users. See Users, roles and permissions.
access/roles.yaml
| Key | Type | Default | Meaning |
|---|---|---|---|
roles | list of objects | Staff roles: your own, or a built-in role restated with new permissions | |
roles[].id | string | Written for you | The element’s stable id. Written by engine-dmo check --fix; never write or change it by hand |
roles[].key | string | Required | The role’s key; a built-in key replaces that role |
roles[].name | map of string | Its name per locale | |
roles[].permissions | list of string | Required | The permissions the role grants, such as content.publish. engine-dmo access matrix shows the effect |
access/grants.yaml
| Key | Type | Default | Meaning |
|---|---|---|---|
grants | list of objects | Grants of a role to a staff group, optionally narrowed by a scope | |
grants[].group | string | Required | The staff group key |
grants[].role | string | Required | The role key |
grants[].scope | object | Everything | Narrows where the role applies; each key given must match |
grants[].scope.locale | list of string | Locale codes | |
grants[].scope.owner | string | any | any, self (documents the person created) or own_group (documents created by anyone in the granted group) |
grants[].scope.site | list of string | Site keys | |
grants[].scope.state | list of string | Document states | |
grants[].scope.tag | list of string | Tag keys | |
grants[].scope.type | list of string | Content type keys |
Schema files
Every key of a content type file (config/schema/<type>.yaml), of a field definition, and of the shared field groups (schema/_shared.yaml), shared blocks (blocks/_index.yaml) and CRM and enquiry custom field files that use the same field grammar.
Portal files
Every key of config/portal/portal.yaml (the member portal's install defaults, member report rules and invitation timings), config/sites/<key>/portal.yaml (a site's portal, screens and actions) and config/portal/roles.yaml (partner roles), all engine-dmo.