/iblai-vibe-rbac
Reference skill for the ibl.ai role-based access control system. Lists
the default RBAC roles the platform seeds (Tenant Admin, Students,
Mentor Editor / Mentor Viewer, Analytics Viewer, Notification Manager,
Enrollment Manager, CRM roles, etc.) and points to the live endpoint
that returns every action definition. Use this when you need to
build, audit, or extend RBAC behavior — most apps only need the SDK's
drop-in management UI (<Admin> → Roles + Policies tabs) plus
per-resource gating via checkRbacPermission. Mention or open this
skill before writing custom RBAC UI from scratch.
Common setup (brand, conventions, env files, verification): see docs/skill-setup.md.
SDK components — drop-in Roles + Policies UI
For 99% of apps the management UI doesn't need to be hand-rolled. The
SDK ships the components that the Account dialog uses (the screenshot
above is the Policies tab inside <Admin>):
| Component |
Description |
<Admin> |
Full management surface — Users, Groups, Roles, Policies, Teams, Alerts. Tabs are permission-gated via the has*TabPermission props (e.g. hasRolesTabPermission, hasPoliciesTabPermission). Pass enableRbac + rbacPermissions to drive those flags from checkRbacPermission results. Already mounted inside the SDK <Account> modal — most apps reach it via /iblai-vibe-account. |
<RolesTab tenant={key} /> |
Standalone Roles tab — table of roles for the organization + create/edit/delete dialogs. The "actions" / "data_actions" pickers list every action definition from the endpoint below. |
<PoliciesTab tenant={key} /> |
Standalone Policies tab — bind a role to a set of resources for users/groups. Resources are hierarchical (/platforms/<pk>/mentors/<pk>/) and the picker handles that. |
All three live in @iblai/iblai-js/web-containers. For agent-scoped
sharing (editor / chat roles on a single agent) use <AgentAccessTab>
from /iblai-vibe-agent-access instead — it wraps the underlying
Ibl.Mentor/ShareMentor/... API. For per-action permission gating in
your own UI use checkRbacPermission(rbacPermissions, path, enableRbac)
from @iblai/iblai-js/web-utils.
Action definitions endpoint
The full list of every action the platform recognizes:
GET https://api.$DOMAIN/dm/api/core/rbac/actions/definitions/
Authorization: Token <dm-token>
($DOMAIN is DOMAIN from iblai.env, default iblai.app.)
Use this when authoring a custom role's actions / data_actions
array or when validating that an action string is real before you ship
it in a policy migration. <RolesTab> calls this endpoint internally
to populate its action picker.
Default roles
The seed bundles the platform ships with. Use them as starting points
when authoring new roles via <RolesTab> or POST rbac/roles/ (see
/iblai-vibe-agent-access → "Roles CRUD" for the REST contract).
Full Python definitions of every default role (with their actions and
data_actions arrays) live in
references/default-roles.py.
Open or copy that file when you need the exact action strings.
| Role |
Summary |
TENANT_ADMIN |
Ibl.* everywhere — full organization control. |
STUDENT |
Chat + read settings/prompts/tools/disclaimers/MCP for agents granted to them; reads field-level agent + settings data. |
STUDENT_MENTOR_VIEWERS |
List agents (filtered to what they have access to). |
MENTOR_VIEWER |
Read-only agent + settings + prompts + documents + reports + chat. Apply to /platforms/{pk}/mentors/{pk}/. |
MENTOR_EDITOR |
Agent read + write across settings, prompts, documents, artifacts, disclaimers, grader. Apply to /platforms/{pk}/mentors/{pk}/. |
MENTOR_CREATORS |
Create new agents (Ibl.Mentor/Mentors/action). |
MENTOR_ANALYTICS_VIEWER |
View per-agent analytics; subsumes STUDENT. |
ANALYTICS_VIEWER |
View the analytics dashboard. Pair with Ibl.Analytics/Core/read or Ibl.Analytics/Reports/read on a user/team scope. |
READ_ANALYTICS |
Per-target analytics + report reads. Apply to /platforms/{pk}/users/{pk}/ or /platforms/{pk}/usergroups/{pk}/. |
NOTIFICATION_MANAGER |
Send notifications + manage templates (scope-gated). |
SEND_NOTIFICATIONS |
Send notifications to a specific user / team. Apply to /platforms/{pk}/users/{pk}/ or /platforms/{pk}/usergroups/{pk}/. |
ENROLLMENT_MANAGER |
Manage course / pathway / program enrollments and invitations. |
LIST_USERS / LIST_TEAMS |
List users / teams for pickers. |
CREATE_TEAMS |
Create a UserGroup (team). |
READ_TEAM / EDIT_TEAM |
Per-team read / write. Apply to /platforms/{pk}/usergroups/{pk}/. |
GROUP_MENTOR_MANAGER |
List + read RBAC groups. |
LLM_USERS / LLM_MODEL_ACCESS |
List or read individual LLM providers / models the user is allowed to use. |
SELL_ITEMS |
Gate that allows selling items on the platform. |
BILLING_MANAGER |
Read + write platform credit settings. |
CRM_VIEWER / CRM_USER / CRM_MANAGER / CRM_INVITER |
Tiered CRM access — read / use / administer / invite leads. |
WATCHED_GROUP_LIST / WATCHED_GROUP_READ |
List / read watched groups for alerts. |
WATCHED_GROUP_WATCHER_GRANTS |
Extra analytics grants given to watchers on a WatchedGroup. |
Step-by-step: define a custom role
- Pick the action strings. Fetch the live action definitions
endpoint above (or open
references/default-roles.py for known-good
examples). Use Ibl.* wildcards sparingly — they bypass field-level
reads.
- Pick the resources the role applies to. Resources are
hierarchical and rooted at
/platforms/{pk}/.... Granting on
/platforms/{pk}/mentors/ covers every agent; granting on
/platforms/{pk}/mentors/{pk}/ scopes to one.
- Create the role via
<RolesTab> (UI) or POST rbac/roles/ (API).
Body: { name, platform_key, actions[], data_actions[] }. See
/iblai-vibe-agent-access → "Roles CRUD" for the full REST contract.
- Bind the role to users / groups via
<PoliciesTab> (UI) or
POST rbac/policies/. Body: { platform_key, name, role_id, resources[], user_ids[], group_ids[] }. Resources must start with
/platforms/ and end with /.
- Gate UI in your app with
checkRbacPermission(rbacPermissions, path, enableRbac) after calling POST rbac/permissions/check/ to
hydrate rbacPermissions. The permissions object on each resource
response also exposes per-field / per-object flags you can use
directly.
Related skills
/iblai-vibe-agent-access -- agent-scoped sharing (editor / chat roles on
a single agent) via <AgentAccessTab>. Documents the underlying
REST contract (rbac/roles/, rbac/policies/, rbac/groups/,
rbac/mentor-access/, rbac/teams/access/, etc.)./iblai-vibe-account -- mounts the SDK <Account> modal that hosts the
<Admin> management UI (Users · Groups · Roles · Policies · Teams ·
Alerts).- Brand guidelines: BRAND.md
1---2name: iblai-vibe-rbac3description: Use when building, auditing, or extending ibl.ai role-based access control — default roles seeded by the platform, the action-definitions endpoint, and the SDK components (Admin, RolesTab, PoliciesTab) that render the Roles + Policies management UI. For agent-scoped sharing (editor / chat roles on a single agent) see /iblai-vibe-agent-access; for mounting the host Account modal see /iblai-vibe-account.4---56# /iblai-vibe-rbac78Reference skill for the ibl.ai role-based access control system. Lists9the default RBAC roles the platform seeds (`Tenant Admin`, `Students`,10`Mentor Editor` / `Mentor Viewer`, `Analytics Viewer`, `Notification Manager`,11Enrollment Manager, CRM roles, etc.) and points to the live endpoint12that returns every action definition. Use this when you need to13build, audit, or extend RBAC behavior — most apps only need the SDK's14drop-in management UI (`<Admin>` → Roles + Policies tabs) plus15per-resource gating via `checkRbacPermission`. Mention or open this16skill before writing custom RBAC UI from scratch.17181920> **Common setup (brand, conventions, env files, verification):** see [docs/skill-setup.md](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/docs/skill-setup.md).2122## SDK components — drop-in Roles + Policies UI2324For 99% of apps the management UI doesn't need to be hand-rolled. The25SDK ships the components that the Account dialog uses (the screenshot26above is the Policies tab inside `<Admin>`):2728| Component | Description |29|-----------|-------------|30| `<Admin>` | Full management surface — Users, Groups, **Roles**, **Policies**, Teams, Alerts. Tabs are permission-gated via the `has*TabPermission` props (e.g. `hasRolesTabPermission`, `hasPoliciesTabPermission`). Pass `enableRbac` + `rbacPermissions` to drive those flags from `checkRbacPermission` results. Already mounted inside the SDK `<Account>` modal — most apps reach it via `/iblai-vibe-account`. |31| `<RolesTab tenant={key} />` | Standalone Roles tab — table of roles for the organization + create/edit/delete dialogs. The "actions" / "data_actions" pickers list every action definition from the endpoint below. |32| `<PoliciesTab tenant={key} />` | Standalone Policies tab — bind a role to a set of resources for users/groups. Resources are hierarchical (`/platforms/<pk>/mentors/<pk>/`) and the picker handles that. |3334All three live in `@iblai/iblai-js/web-containers`. For agent-scoped35sharing (editor / chat roles on a single agent) use `<AgentAccessTab>`36from `/iblai-vibe-agent-access` instead — it wraps the underlying37`Ibl.Mentor/ShareMentor/...` API. For per-action permission gating in38your own UI use `checkRbacPermission(rbacPermissions, path, enableRbac)`39from `@iblai/iblai-js/web-utils`.4041## Action definitions endpoint4243The full list of every action the platform recognizes:4445```46GET https://api.$DOMAIN/dm/api/core/rbac/actions/definitions/47Authorization: Token <dm-token>48```4950(`$DOMAIN` is `DOMAIN` from `iblai.env`, default `iblai.app`.)5152Use this when authoring a custom role's `actions` / `data_actions`53array or when validating that an action string is real before you ship54it in a policy migration. `<RolesTab>` calls this endpoint internally55to populate its action picker.5657## Default roles5859The seed bundles the platform ships with. Use them as starting points60when authoring new roles via `<RolesTab>` or `POST rbac/roles/` (see61`/iblai-vibe-agent-access` → "Roles CRUD" for the REST contract).6263Full Python definitions of every default role (with their `actions` and64`data_actions` arrays) live in65[`references/default-roles.py`](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/skills/users/iblai-vibe-rbac/references/default-roles.py).66Open or copy that file when you need the exact action strings.6768| Role | Summary |69|------|---------|70| `TENANT_ADMIN` | `Ibl.*` everywhere — full organization control. |71| `STUDENT` | Chat + read settings/prompts/tools/disclaimers/MCP for agents granted to them; reads field-level agent + settings data. |72| `STUDENT_MENTOR_VIEWERS` | List agents (filtered to what they have access to). |73| `MENTOR_VIEWER` | Read-only agent + settings + prompts + documents + reports + chat. Apply to `/platforms/{pk}/mentors/{pk}/`. |74| `MENTOR_EDITOR` | Agent read + write across settings, prompts, documents, artifacts, disclaimers, grader. Apply to `/platforms/{pk}/mentors/{pk}/`. |75| `MENTOR_CREATORS` | Create new agents (`Ibl.Mentor/Mentors/action`). |76| `MENTOR_ANALYTICS_VIEWER` | View per-agent analytics; subsumes `STUDENT`. |77| `ANALYTICS_VIEWER` | View the analytics dashboard. Pair with `Ibl.Analytics/Core/read` or `Ibl.Analytics/Reports/read` on a user/team scope. |78| `READ_ANALYTICS` | Per-target analytics + report reads. Apply to `/platforms/{pk}/users/{pk}/` or `/platforms/{pk}/usergroups/{pk}/`. |79| `NOTIFICATION_MANAGER` | Send notifications + manage templates (scope-gated). |80| `SEND_NOTIFICATIONS` | Send notifications to a specific user / team. Apply to `/platforms/{pk}/users/{pk}/` or `/platforms/{pk}/usergroups/{pk}/`. |81| `ENROLLMENT_MANAGER` | Manage course / pathway / program enrollments and invitations. |82| `LIST_USERS` / `LIST_TEAMS` | List users / teams for pickers. |83| `CREATE_TEAMS` | Create a UserGroup (team). |84| `READ_TEAM` / `EDIT_TEAM` | Per-team read / write. Apply to `/platforms/{pk}/usergroups/{pk}/`. |85| `GROUP_MENTOR_MANAGER` | List + read RBAC groups. |86| `LLM_USERS` / `LLM_MODEL_ACCESS` | List or read individual LLM providers / models the user is allowed to use. |87| `SELL_ITEMS` | Gate that allows selling items on the platform. |88| `BILLING_MANAGER` | Read + write platform credit settings. |89| `CRM_VIEWER` / `CRM_USER` / `CRM_MANAGER` / `CRM_INVITER` | Tiered CRM access — read / use / administer / invite leads. |90| `WATCHED_GROUP_LIST` / `WATCHED_GROUP_READ` | List / read watched groups for alerts. |91| `WATCHED_GROUP_WATCHER_GRANTS` | Extra analytics grants given to watchers on a WatchedGroup. |9293## Step-by-step: define a custom role94951. **Pick the action strings.** Fetch the live action definitions96 endpoint above (or open `references/default-roles.py` for known-good97 examples). Use `Ibl.*` wildcards sparingly — they bypass field-level98 reads.992. **Pick the resources the role applies to.** Resources are100 hierarchical and rooted at `/platforms/{pk}/...`. Granting on101 `/platforms/{pk}/mentors/` covers every agent; granting on102 `/platforms/{pk}/mentors/{pk}/` scopes to one.1033. **Create the role via `<RolesTab>` (UI) or `POST rbac/roles/` (API).**104 Body: `{ name, platform_key, actions[], data_actions[] }`. See105 `/iblai-vibe-agent-access` → "Roles CRUD" for the full REST contract.1064. **Bind the role to users / groups via `<PoliciesTab>` (UI) or107 `POST rbac/policies/`.** Body: `{ platform_key, name, role_id,108 resources[], user_ids[], group_ids[] }`. Resources must start with109 `/platforms/` and end with `/`.1105. **Gate UI in your app** with `checkRbacPermission(rbacPermissions,111 path, enableRbac)` after calling `POST rbac/permissions/check/` to112 hydrate `rbacPermissions`. The `permissions` object on each resource113 response also exposes per-field / per-object flags you can use114 directly.115116## Related skills117118- `/iblai-vibe-agent-access` -- agent-scoped sharing (editor / chat roles on119 a single agent) via `<AgentAccessTab>`. Documents the underlying120 REST contract (`rbac/roles/`, `rbac/policies/`, `rbac/groups/`,121 `rbac/mentor-access/`, `rbac/teams/access/`, etc.).122- `/iblai-vibe-account` -- mounts the SDK `<Account>` modal that hosts the123 `<Admin>` management UI (Users · Groups · Roles · Policies · Teams ·124 Alerts).125- **Brand guidelines**: [BRAND.md](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/BRAND.md)
iblai