Permissions

A permission is a named atomic action a user can be allowed to perform — read a page, create a page, upload an attachment, and so on. Permissions are the building blocks of Roles: every role is a bundle of permissions, and a user's effective rights are the union of all permissions across every role they hold.

GeoHazardWatch uses simple string keys for permissions (e.g. page-edit, asset-upload). They are deliberately flat — no Context/Resource/Action triple, no scoping by namespace. The per-page rules (Page Private, Author Lock, Page Audience) operate at a layer above permissions; they override what a role-granted permission would otherwise allow.

Live Permissions Catalog

The table below is rendered from the live configuration at view time. It groups permissions by the resource they act on (page-*, asset-*, search-*, user-*, admin-*).

Account Permissions

Permission	Icon	What it lets you do
`account-security`		Change your password, email and sign-in methods, and approve devices

Admin Permissions

Permission	Icon	What it lets you do
`admin-read`		View administration screens without changing anything
`admin-system`		Administer the site
`admin-roles`		Manage roles

Asset Permissions

Permission	Icon	What it lets you do
`asset-read`		View attachments
`asset-upload`		Upload attachments
`asset-delete`		Delete attachments
`asset-edit`		Edit attachment details such as photo information

Audit Permissions

Permission	Icon	What it lets you do
`audit-export`		Export the audit trail

Comment Permissions

Permission	Icon	What it lets you do
`comment-create`		Add comments and delete your own

Config Permissions

Permission	Icon	What it lets you do
`config-manage`		Change site settings and download backups

Identity Permissions

Permission	Icon	What it lets you do
`identity-read`		Find and view identity records (users, contacts and organizations)
`identity-manage`		Add, change and link identity records (users, contacts and organizations)

Media Permissions

Permission	Icon	What it lets you do
`media-read`		Browse and view the media library

Page Permissions

Permission	Icon	What it lets you do
`page-read`		View pages
`page-edit`		Edit pages
`page-public`		Make a page public by moving it out of its vault
`page-create`		Create pages
`page-delete`		Delete pages
`page-rename`		Rename pages
`page-export`		Export pages
`page-raw-edit`		Edit a page's raw file, skipping the page editor's checks

Profile Permissions

Permission	Icon	What it lets you do
`profile-manage`		Manage your own profile and preferences

Proxy Permissions

Permission	Icon	What it lets you do
`proxy-grant`		Let someone act for you, and stop them

Search Permissions

Permission	Icon	What it lets you do
`search-page`		Search pages
`search-user`		Search for people

Secret Permissions

Permission	Icon	What it lets you do
`secret-reveal`		Show hidden configuration secrets

Session Permissions

Permission	Icon	What it lets you do
`session-revoke`		Sign other people out

Share Permissions

Permission	Icon	What it lets you do
`share-create`		Create share links and see your own
`share-extend`		Extend your own share links
`share-revoke`		Revoke your own share links

Store Permissions

Permission	Icon	What it lets you do
`store-create`		Create your own private store

Token Permissions

Permission	Icon	What it lets you do
`token-mint`		Make and revoke your own agent tokens
`token-extend`		Extend your own agent tokens

User Permissions

Permission	Icon	What it lets you do
`user-read`		View the list of people and their profiles
`user-edit`		Edit people's accounts
`user-create`		Create accounts
`user-delete`		Delete accounts

Vault Permissions

Permission	Icon	What it lets you do
`vault-proxy`		Let someone acting for you into your vaults

Total: 39 permissions in 19 groups

Roles × Permissions Matrix

Which roles grant which permissions, rendered live:

Security Policy Summary

Permissions matrix showing which roles have which permissions, derived from the access policies

Permission	Administrator	User Administrator	Editor	Contributor	Demo Administrator	Vault Owner	Reader	Anonymous
`page-read` View pages
`page-edit` Edit pages
`page-public` Make a page public by moving it out of its vault
`page-create` Create pages
`page-delete` Delete pages
`page-rename` Rename pages
`page-export` Export pages
`asset-read` View attachments
`media-read` Browse and view the media library
`asset-upload` Upload attachments
`asset-delete` Delete attachments
`share-create` Create share links and see your own
`share-extend` Extend your own share links
`share-revoke` Revoke your own share links
`profile-manage` Manage your own profile and preferences
`account-security` Change your password, email and sign-in methods, and approve devices
`config-manage` Change site settings and download backups
`secret-reveal` Show hidden configuration secrets
`comment-create` Add comments and delete your own
`token-mint` Make and revoke your own agent tokens
`token-extend` Extend your own agent tokens
`proxy-grant` Let someone act for you, and stop them
`vault-proxy` Let someone acting for you into your vaults
`store-create` Create your own private store
`asset-edit` Edit attachment details such as photo information
`search-page` Search pages
`search-user` Search for people
`user-read` View the list of people and their profiles
`user-edit` Edit people's accounts
`user-create` Create accounts
`user-delete` Delete accounts
`identity-read` Find and view identity records (users, contacts and organizations)
`identity-manage` Add, change and link identity records (users, contacts and organizations)
`admin-read` View administration screens without changing anything
`admin-system` Administer the site
`admin-roles` Manage roles
`page-raw-edit` Edit a page's raw file, skipping the page editor's checks
`session-revoke` Sign other people out
`audit-export` Export the audit trail

Total Permissions: 39 | Total Roles: 8

Reading the Tables

Permission — the lowercase string key used in Roles definitions and in access-policy actions lists
Description — short summary of what the permission allows
Group prefix (page, asset, search, user, admin) — the resource the permission operates on

How Permissions Are Checked

When a user attempts an action on a page, the access-control flow is:

Tier 0 — Private pages restrict to admins and the page creator regardless of permissions. See Page Private.
Tier 1 — Per-page overrides (audience or access) take precedence over role permissions for that page. See Page Audience.
Tier 2 — Global access policies grant or deny based on the user's roles and their associated permissions.

A user must hold at least one role whose permission set grants the requested action — unless a per-page override allows them explicitly.

Permissions (Documentation)

GeoHazardWatch