Scopes and Roles
Canonical Reference: The single authoritative source of truth for scope strings is the
StellaOps.Auth.Abstractions.StellaOpsScopesclass (src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsScopes.cs), which currently declares 150+ distinct scopes (StellaOpsScopes.Allis reflected from its publicconst stringfields). For prose descriptions, surface mappings, and role/configuration examples see authority-scopes.md — note that the narrative catalogue there may lag the const list, so reconcile againstStellaOpsScopeswhen in doubt.
This document defines the scope taxonomy and how scopes map to roles across StellaOps. It is intentionally cross-cutting and does not attempt to list every module-specific scope; the StellaOpsScopes const list, module dossiers, and gateway contracts are the source of truth for per-surface requirements.
Terms
- Scope: an OAuth2/OIDC scope string granted to a client/user token and enforced by the gateway and services.
- Role: a human-friendly grouping of scopes, assigned per tenant (often via RBAC in Authority/Console).
- ABAC claims: optional attribute filters that constrain a token further (e.g., environment, namespace, project).
Scope Naming Conventions
Most scopes follow an <area>:<verb> shape, but the catalog is not uniform — both the separator and the verb set vary by module. Treat the canonical const list in StellaOps.Auth.Abstractions.StellaOpsScopes as the source of truth for the exact string; the conventions below are descriptive, not normative.
- Common shape:
<area>:<verb>(colon), e.g.policy:read,scanner:scan,vuln:investigate. - Verbs are small but not closed.
read/write/adminare the most common, alongsidesimulate,approve,audit,operate,view,ingest,create,export,publish,promote,rotate,sign, and others. Do not assume a fixed verb list. - Dot-separated scopes exist and are intentional. A large set predate or deliberately deviate from the colon convention, e.g.
concelier.jobs.trigger,concelier.merge,vex.admin,ui.read,ui.admin,notify.viewer/notify.operator/notify.admin,export.viewer/export.operator/export.admin,packs.read/packs.write/packs.run/packs.approve,analytics.read,ops.health,registry.admin,platform.context.read,scanner.signed-sbom-material.write. The separator is part of the literal scope string and is matched exactly. - Multi-segment scopes exist. Some use three segments, e.g.
airgap:status:read,crypto:profile:admin,crypto:kek:read/crypto:kek:rotate,platform:federation:read,platform:sar:erase,connector:credentials:read/connector:credentials:write,concelier:credentials:dry-run.
Examples that appear across current contracts and module dossiers (verified against StellaOpsScopes):
- Vulnerability Explorer:
vuln:view,vuln:investigate,vuln:operate,vuln:audit. (vuln:readstill exists but is deprecated — theStellaOpsScopes.VulnReadconst is marked[Obsolete]and is normalized tovuln:viewby the authorization handler; new grants should usevuln:view.) - Exception governance:
exceptions:read,exceptions:write,exceptions:approve,exceptions:request. (Note the pluralexceptionsprefix — there is noexception:*singular scope in the catalog.) - Policy:
policy:read,policy:simulate(and a broad lifecycle set:policy:write,policy:author,policy:edit,policy:review,policy:submit,policy:approve,policy:operate,policy:publish,policy:promote,policy:audit,policy:run,policy:activate). - Replay:
replay:readfor deterministic verification/recomputation and replay-state reads;replay:writefor explicit durable token, bundle, manifest, and snapshot production. - VEX ingestion:
vex:read,vex:ingest,vex.admin(the admin scope uses a dot, the others use colons).
Typical Role Shapes (Tenant-Local)
Exact role names vary per deployment, but the intent is stable:
- Viewer: read-only access to findings/evidence for a tenant.
- Operator: can triage findings and create workflow objects (comments, assignments, exports).
- Developer deployer: can read owned service evidence, scan/update candidate image digests, and update or request updates only for assigned service/environment pairs.
- Approver: can approve/reject workflow objects that change gating (exceptions, waivers) for a tenant.
- Auditor: can access audit exports, histories, and verification surfaces.
- Admin: tenant administration (RBAC, client credentials, quotas, configuration).
Default role catalog (shipped bundles)
Authority ships a concrete default role catalog that the Console role editor exposes; it is defined by ConsoleAdminEndpointExtensions.GetDefaultRoles() (each RoleBundle maps a role/<id> to an explicit scope set). These are the seeded bundles — operators can still assemble custom roles from any scope in the authority.permissions catalog. As of this writing the shipped bundles are:
| Role ID | Display name | Scope bundle (from source) |
|---|---|---|
role/console-viewer | Console Viewer | ui.read |
role/console-admin | Console Admin | ui.read, ui.admin, and the full authority:* management set (tenants, users, roles, clients, tokens, branding read/write/revoke) plus authority.audit.read |
role/executive-assurance-viewer | Executive Assurance Viewer | ui.read, release:read, policy:read, policy:audit, findings:read, evidence:read, replay:read, graph:read, export.viewer, authority.audit.read, timeline:read, platform.context.read |
role/release-operations-steward | Release Operations Steward | ui.read, release:read, release:write, orch:read, orch:operate, scanner:read, scanner:scan, sbom:read, policy:read, findings:read, evidence:read, platform.context.read |
role/security-risk-manager | Security Risk Manager | ui.read, release:read, scanner:read, scanner:scan, sbom:read, registry:read, integration:read, findings:read, vuln:view, vuln:investigate, policy:read, policy:simulate, evidence:read, graph:read, advisory:read, vex:read, timeline:read |
role/service-release-contributor | Service Release Contributor | ui.read, ui.preferences.read, ui.preferences.write, release:read, release:write, orch:read, scanner:read, scanner:scan, sbom:read, policy:read, findings:read, evidence:read, vuln:view, platform.context.read (ABAC-constrained — see Product User Shapes; deliberately excludes release:publish, release:bypass, ui.admin, policy:approve, orch:operate) |
role/scanner-viewer | Scanner Viewer | scanner:read |
role/scanner-operator | Scanner Operator | scanner:read, scanner:scan, scanner:export |
role/scanner-signed-sbom-writer | Scanner Signed SBOM Writer | scanner.signed-sbom-material.write |
role/scanner-admin | Scanner Admin | scanner:read, scanner:scan, scanner:export, scanner:write |
Product User Shapes
The common product-facing users map onto these role shapes, and each corresponds to a concrete role/* bundle in the default catalog above:
- Executive Assurance Viewer (
role/executive-assurance-viewer): Viewer/Auditor over releases, evidence, assurance, and audit state, with deterministic Verify throughreplay:read; it has no replay production or vulnerability mutation authority. - Release Operations Steward (
role/release-operations-steward): Operator over topology, deployments, promotions, and recovery workflows. (The shipped bundle grantsrelease:writeandorch:operatebut not approval scopes such aspolicy:approveorrelease:publish; approver capability is added separately.) - Security Risk Manager (
role/security-risk-manager): Operator/Auditor over findings, risk, VEX, and policy. (The shipped bundle is read/simulate-oriented —release:readandintegration:readprovide contextual data without release or integration mutation, whilevuln:investigateandpolicy:simulateprovide its bounded actions. It does not by default grantrelease:write,integration:write,integration:operate,exceptions:approve, orpolicy:audit; add the appropriate approval/audit scopes only for broader duties.) - Service Release Contributor (
role/service-release-contributor): ABAC-limited service deployer over owned services and allowed environments.
Service release contributor access must be ABAC-constrained. The supported attribute keys are fixed by ConsoleAdminEndpointExtensions.DeveloperAbacAttributeKeys: serviceIds, repositoryIds, imageNamespaces (service ownership), environmentIds and maxEnvironmentType (allowed target environments), and directUpdateAllowed (whether the environment permits direct updates or only promotion requests). Release Orchestrator re-checks those claims when a contributor calls POST /api/v1/release-orchestrator/deployments for a direct update or POST /api/v1/release-orchestrator/approvals/developer-requests for an approval request. A mutable tag is not enough; contributor update actions require an immutable sha256: candidate digest. The approval-request path can carry a newly built digest even before an operator-created release row exists; the backend derives a deterministic self-service update release key and preserves service, digest, environment, and actor metadata.
Authority admin user summaries include the supported service-release ABAC attributes, and the Console user editor exposes them when role/service-release-contributor or the legacy developer role is selected. “Legacy developer role” here refers to the developer / role/release-developer role names that AuthorizeEndpoint still treats as equivalent to role/service-release-contributor when applying the developer scope allow-list. Administrators must confirm mixed grants that combine service-release contribution with broad admin, operator, bypass, publisher, or policy-approver roles. LDAP and Active Directory mappings should attach the same attributes from directory claims or synchronized user metadata instead of using role/console-admin as a shortcut.
Default setup uses SQL/local users. LDAP Directory and Active Directory can be added as authentication providers and must map directory groups to these role bundles instead of granting role/console-admin to every external user.
Enforcement Model (Where Scopes Are Checked)
- Authority issues tokens and embeds scopes (and optional ABAC claims).
- Gateway (when present) performs consistent scope enforcement and tenant routing.
- Services validate tenant context and enforce scope checks at endpoint boundaries.
- Service-to-service calls may use short-lived, sender-constrained tokens (OpTok/DPoP/mTLS) in addition to scopes.
References
- Scope prose catalogue and surface mappings: authority-scopes.md
- Tenancy model and isolation: tenancy-overview.md
- Exceptions API entry point: …/api/exceptions.md
- Policy + Exceptions gateway contract: …/api/gateway/policy-exceptions.md
