[{"data":1,"prerenderedAt":576},["ShallowReactive",2],{"navigation":3,"\u002Fenterprise\u002Fcore-authorization-concepts":189,"\u002Fenterprise\u002Fcore-authorization-concepts-surround":571},[4,34,60,116,137,153],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":33},"Getting Started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,15,18,23,28],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":5,"path":16,"stem":17,"icon":6},"\u002Fgetting-started\u002Fgetting-started","1.getting-started\u002F2.getting-started",{"title":19,"path":20,"stem":21,"icon":22},"Choosing a Preset","\u002Fgetting-started\u002Fchoosing-a-preset","1.getting-started\u002F3.choosing-a-preset","i-lucide-git-branch",{"title":24,"path":25,"stem":26,"icon":27},"Deployment","\u002Fgetting-started\u002Fdeployment","1.getting-started\u002F4.deployment","i-lucide-cloud",{"title":29,"path":30,"stem":31,"icon":32},"Background Maintenance","\u002Fgetting-started\u002Fbackground-maintenance","1.getting-started\u002F5.background-maintenance","i-lucide-timer-reset",false,{"title":35,"icon":36,"path":37,"stem":38,"children":39,"page":33},"Build","i-lucide-wrench","\u002Fbuild","2.build",[40,45,50,55],{"title":41,"path":42,"stem":43,"icon":44},"Routers & Prefixes","\u002Fbuild\u002Frouters-and-prefixes","2.build\u002F1.routers-and-prefixes","i-lucide-route",{"title":46,"path":47,"stem":48,"icon":49},"Configuration","\u002Fbuild\u002Fconfiguration","2.build\u002F2.configuration","i-lucide-settings",{"title":51,"path":52,"stem":53,"icon":54},"Authorization Dependencies","\u002Fbuild\u002Fauthorization-dependencies","2.build\u002F3.authorization-dependencies","i-lucide-shield-check",{"title":56,"path":57,"stem":58,"icon":59},"Command Line","\u002Fbuild\u002Fcli","2.build\u002F4.cli","i-lucide-terminal",{"title":61,"icon":62,"path":63,"stem":64,"children":65,"page":33},"Auth","i-lucide-lock","\u002Fauth","3.auth",[66,71,76,81,86,91,96,101,106,111],{"title":67,"path":68,"stem":69,"icon":70},"OAuth & Social Login","\u002Fauth\u002Foauth-and-social-login","3.auth\u002F1.oauth-and-social-login","i-lucide-log-in",{"title":72,"path":73,"stem":74,"icon":75},"Multi-Frontend Support","\u002Fauth\u002Fmulti-frontend","3.auth\u002F10.multi-frontend","i-lucide-layout-grid",{"title":77,"path":78,"stem":79,"icon":80},"Sessions & Audit","\u002Fauth\u002Fsessions-and-audit","3.auth\u002F2.sessions-and-audit","i-lucide-monitor-smartphone",{"title":82,"path":83,"stem":84,"icon":85},"Passwordless & Messaging","\u002Fauth\u002Fpasswordless-and-messaging","3.auth\u002F3.passwordless-and-messaging","i-lucide-mail",{"title":87,"path":88,"stem":89,"icon":90},"JWT Tokens","\u002Fauth\u002Fjwt-tokens","3.auth\u002F4.jwt-tokens","i-lucide-key-round",{"title":92,"path":93,"stem":94,"icon":95},"User Management API","\u002Fauth\u002Fuser-management-api","3.auth\u002F5.user-management-api","i-lucide-users",{"title":97,"path":98,"stem":99,"icon":100},"User Invitations","\u002Fauth\u002Fuser-invitations","3.auth\u002F6.user-invitations","i-lucide-send",{"title":102,"path":103,"stem":104,"icon":105},"Roles & Permissions","\u002Fauth\u002Froles-and-permissions","3.auth\u002F7.roles-and-permissions","i-lucide-shield",{"title":107,"path":108,"stem":109,"icon":110},"ABAC","\u002Fauth\u002Fabac","3.auth\u002F8.abac","i-lucide-filter",{"title":112,"path":113,"stem":114,"icon":115},"User Status","\u002Fauth\u002Fuser-status","3.auth\u002F9.user-status","i-lucide-user-cog",{"title":117,"icon":118,"path":119,"stem":120,"children":121,"page":33},"Enterprise","i-lucide-building-2","\u002Fenterprise","4.enterprise",[122,127,132],{"title":123,"path":124,"stem":125,"icon":126},"Core Authorization Concepts","\u002Fenterprise\u002Fcore-authorization-concepts","4.enterprise\u002F1.core-authorization-concepts","i-lucide-network",{"title":128,"path":129,"stem":130,"icon":131},"Entities","\u002Fenterprise\u002Fentities","4.enterprise\u002F2.entities","i-lucide-folder-tree",{"title":133,"path":134,"stem":135,"icon":136},"Entity Memberships","\u002Fenterprise\u002Fentity-memberships","4.enterprise\u002F3.entity-memberships","i-lucide-user-plus",{"title":138,"icon":139,"path":140,"stem":141,"children":142,"page":33},"Integrations","i-lucide-plug","\u002Fintegrations","5.integrations",[143,148],{"title":144,"path":145,"stem":146,"icon":147},"API Keys","\u002Fintegrations\u002Fapi-keys","5.integrations\u002F1.api-keys","i-lucide-key",{"title":149,"path":150,"stem":151,"icon":152},"OutlabsAuth UI","\u002Fintegrations\u002Foutlabsauth-ui","5.integrations\u002F2.outlabsauth-ui","i-lucide-layout-dashboard",{"title":154,"icon":155,"path":156,"stem":157,"children":158,"page":33},"Reference","i-lucide-book-marked","\u002Freference","6.reference",[159,164,169,174,179,184],{"title":160,"path":161,"stem":162,"icon":163},"Data Models","\u002Freference\u002Fdata-models","6.reference\u002F1.data-models","i-lucide-database",{"title":165,"path":166,"stem":167,"icon":168},"Activity Tracking","\u002Freference\u002Factivity-tracking","6.reference\u002F2.activity-tracking","i-lucide-activity",{"title":170,"path":171,"stem":172,"icon":173},"Testing","\u002Freference\u002Ftesting","6.reference\u002F3.testing","i-lucide-flask-conical",{"title":175,"path":176,"stem":177,"icon":178},"Observability","\u002Freference\u002Fobservability","6.reference\u002F4.observability","i-lucide-eye",{"title":180,"path":181,"stem":182,"icon":183},"Metrics Reference","\u002Freference\u002Fmetrics-reference","6.reference\u002F5.metrics-reference","i-lucide-chart-bar",{"title":185,"path":186,"stem":187,"icon":188},"Log Events Reference","\u002Freference\u002Flog-events-reference","6.reference\u002F6.log-events-reference","i-lucide-scroll-text",{"id":190,"title":123,"body":191,"description":564,"extension":565,"links":566,"meta":567,"navigation":568,"path":124,"seo":569,"stem":125,"__hash__":570},"docs\u002F4.enterprise\u002F1.core-authorization-concepts.md",{"type":192,"value":193,"toc":549},"minimark",[194,215,218,221,226,301,308,310,314,317,327,330,352,354,358,365,371,383,395,397,401,406,409,414,418,421,432,439,441,445,459,462,481,487,489,493,517,519,523],[195,196,197],"note",{},[198,199,200,201,205,206,208,209,208,211,214],"p",{},"Conceptual guide for implementers. Choosing a preset: ",[202,203,204],"a",{"href":20},"07 — Choosing a Preset",". HTTP surfaces: ",[202,207,102],{"href":103}," · ",[202,210,128],{"href":129},[202,212,213],{"href":134},"Memberships",".",[198,216,217],{},"How users, permissions, roles, and (in Enterprise) entities fit together.",[219,220],"hr",{},[222,223,225],"h2",{"id":224},"building-blocks","Building blocks",[227,228,229,242],"table",{},[230,231,232],"thead",{},[233,234,235,239],"tr",{},[236,237,238],"th",{},"Piece",[236,240,241],{},"Meaning",[243,244,245,270,280,290],"tbody",{},[233,246,247,254],{},[248,249,250],"td",{},[251,252,253],"strong",{},"Permission",[248,255,256,257,261,262,265,266,269],{},"One action, usually ",[258,259,260],"code",{},"resource:action"," (",[258,263,264],{},"user:create",", ",[258,267,268],{},"invoice:approve",")",[233,271,272,277],{},[248,273,274],{},[251,275,276],{},"Role",[248,278,279],{},"Named bundle of permissions",[233,281,282,287],{},[248,283,284],{},[251,285,286],{},"User",[248,288,289],{},"Actor who receives roles (directly or via membership)",[233,291,292,298],{},[248,293,294,297],{},[251,295,296],{},"Entity"," (Enterprise)",[248,299,300],{},"Context — org, office, team, project group",[198,302,303,304,307],{},"Permissions → roles → (assignment) → users. Enterprise inserts ",[251,305,306],{},"where"," into\nassignment via entities and memberships.",[219,309],{},[222,311,313],{"id":312},"simplerbac-who-can-do-what","SimpleRBAC — who can do what?",[198,315,316],{},"Flat model: users get roles for the whole app.",[318,319,324],"pre",{"className":320,"code":322,"language":323},[321],"language-text","Permission \"user:read\"\n      ↓\n   Role \"Viewer\"\n      ↓\n   User (via UserRoleMembership)\n","text",[258,325,322],{"__ignoreMap":326},"",[198,328,329],{},"A user’s effective permissions are the union of all assigned roles.",[198,331,332,333,336,337,340,341,344,345,348,349,214],{},"API: define roles\u002Fpermissions on ",[258,334,335],{},"\u002Fv1\u002Froles"," and ",[258,338,339],{},"\u002Fv1\u002Fpermissions",", assign with\n",[258,342,343],{},"\u002Fv1\u002Fusers\u002F{id}\u002Froles"," — ",[202,346,347],{"href":103},"25",",\n",[202,350,351],{"href":93},"23",[219,353],{},[222,355,357],{"id":356},"enterpriserbac-who-can-do-what-where","EnterpriseRBAC — who can do what, where?",[198,359,360,361,364],{},"Roles apply ",[251,362,363],{},"inside an entity"," (membership), not only globally.",[318,366,369],{"className":367,"code":368,"language":323},[321],"Permission \"user:manage\"     Entity \"Eng. Dept\"\n         ↘                     ↙\n           Role \"Manager\"\n                 ↓\n        User (EntityMembership + role_ids)\n",[258,370,368],{"__ignoreMap":326},[198,372,373,374,378,379,382],{},"Jane is a Manager ",[375,376,377],"em",{},"in Eng. Dept"," — those permissions apply in that context, and\noptionally down the tree when using ",[258,380,381],{},"*_tree"," permissions.",[198,384,385,386,388,389,391,392,394],{},"API: ",[202,387,128],{"href":129}," + ",[202,390,213],{"href":134},".\nDirect user↔role still exists for system-wide grants (",[202,393,351],{"href":93},").",[219,396],{},[222,398,400],{"id":399},"structural-vs-access-group-entities","Structural vs access-group entities",[402,403,405],"h3",{"id":404},"structural","Structural",[198,407,408],{},"Formal org chart — “where you work”:",[198,410,411],{},[258,412,413],{},"Company → Division → Department → Team",[402,415,417],{"id":416},"access-group","Access group",[198,419,420],{},"Cross-cutting group — “what you’re working on” (project team, working group).",[198,422,423,424,427,428,431],{},"Example: ACME has Finance \u002F Engineering \u002F Marketing. Project Phoenix needs\nAlice, Bob, and Carol with ",[258,425,426],{},"phoenix:edit_document",". Create an ",[251,429,430],{},"access_group","\nentity “Project Phoenix Team”, give them a project role there. Their structural\nmemberships stay unchanged; revoke the access-group membership when the project\nends.",[198,433,434,435,438],{},"Permission checks aggregate ",[251,436,437],{},"all"," active memberships (structural + groups).",[219,440],{},[222,442,444],{"id":443},"tree-permissions-and-closure","Tree permissions and closure",[198,446,447,448,451,452,455,456,214],{},"Enterprise stores ancestor→descendant links in a ",[251,449,450],{},"closure table"," so subtree\nqueries stay fast. Permissions named like ",[258,453,454],{},"invoice:approve_tree"," grant the\naction on an entity ",[251,457,458],{},"and its descendants",[198,460,461],{},"Hosts usually:",[463,464,465,472],"ul",{},[466,467,468,469],"li",{},"Navigate with ",[258,470,471],{},"\u002Fentities\u002F{id}\u002Fchildren|descendants|path",[466,473,474,475,388,478],{},"Authorize with tree-aware deps \u002F ",[258,476,477],{},"POST \u002Fpermissions\u002Fcheck",[258,479,480],{},"entity_id",[198,482,483,484,214],{},"Details: ",[202,485,486],{"href":129},"51 — Entities",[219,488],{},[222,490,492],{"id":491},"custom-types-and-depth","Custom types and depth",[198,494,495,498,499,265,502,265,505,508,509,512,513,516],{},[258,496,497],{},"entity_type"," is a free-form string (",[258,500,501],{},"organization",[258,503,504],{},"office",[258,506,507],{},"team",", …). Root\nallowed types come from ",[258,510,511],{},"\u002Fv1\u002Fconfig\u002Fentity-types","; parents can further restrict\nchildren via ",[258,514,515],{},"allowed_child_*",". Depth is capped by config (default max depth\naround 10).",[219,518],{},[222,520,522],{"id":521},"related","Related",[463,524,525,529,533,537,541],{},[466,526,527],{},[202,528,19],{"href":20},[466,530,531],{},[202,532,102],{"href":103},[466,534,535],{},[202,536,128],{"href":129},[466,538,539],{},[202,540,133],{"href":134},[466,542,543,544],{},"Maintainer depth: ",[202,545,546],{"href":20},[258,547,548],{},"docs\u002FCOMPARISON_MATRIX.md",{"title":326,"searchDepth":550,"depth":551,"links":552},1,2,[553,554,555,556,561,562,563],{"id":224,"depth":551,"text":225},{"id":312,"depth":551,"text":313},{"id":356,"depth":551,"text":357},{"id":399,"depth":551,"text":400,"children":557},[558,560],{"id":404,"depth":559,"text":405},3,{"id":416,"depth":559,"text":417},{"id":443,"depth":551,"text":444},{"id":491,"depth":551,"text":492},{"id":521,"depth":551,"text":522},"Users, roles, permissions, entities, and tree access.","md",null,{},{"icon":126},{"title":123,"description":564},"cNKxR-Uwe7-ubYG5EAlHoFzS7DDD0Ly7eCu2M8r_FNo",[572,574],{"title":112,"path":113,"stem":114,"description":573,"icon":115,"children":-1},"Active, invited, suspended, banned, deleted.",{"title":128,"path":129,"stem":130,"description":575,"icon":131,"children":-1},"Enterprise org tree CRUD, move, children, path.",1787472744721]