Member scope profiles

IdentityHTTPSDKCLIDashboardread_scopewrite_scopePOST /api/users/:id/roleslt_user_roles

Two scope axes on a membership give five profiles, from full worker to auditor, all enforced inside the query.

The situation

Some people work the whole queue. Some see the whole queue and act only on their own items. An auditor watches and changes nothing. All of them are members of the same role, and the difference has to hold everywhere, not just in the dashboard.

The recipe

Set the two axes when you grant the role:

curl -X POST https://lt.acme.dev/api/users/$USER_ID/roles \
  -H "Authorization: Bearer $LT_TOKEN" -H 'Content-Type: application/json' \
  -d '{ "role": "packing", "type": "member", "read_scope": "all", "write_scope": "none" }'

read_scope	write_scope	Profile
`all`	`all`	Full worker: search and act on the whole queue (default)
`all`	`self`	Sees the whole queue, acts only on own items
`self`	`self`	Own items only: a one-time user on a pre-assigned form
`all`	`none`	Read-only observer or auditor
`self`	`none`	Read-only view of one’s own items

self means rows assigned to the member. Releasing, escalating and creating a standalone escalation need write_scope=all.

The guarantee

Write is a subset of read: write_scope=all requires read_scope=all, and the API refuses anything else. Scope folds into SQL, atomic with no gap between check and act: read scope becomes part of the search query, and write scope folds into the atomic resolve and gates the by-id claim, resolve and cancel paths. admin and superadmin grants ignore scope and act on the whole queue. See Identity.

Identity