# Iblai Vibe Rbac > Use when building, auditing, or extending ibl.ai role-based access control — default roles seeded by the platform, the action-definitions endpoint, and the SDK components (Admin, RolesTab, PoliciesTab) that render the Roles + Policies management UI. For agent-scoped sharing (editor / chat roles on a single agent) see /iblai-vibe-agent-access; for mounting the host Account modal see /iblai-vibe-account. - Skill: `iblai/iblai-vibe-rbac` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add iblai/iblai-vibe-rbac` - Raw SKILL.md: https://api.skillmd.com/api/skills/iblai/iblai-vibe-rbac/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: iblai (https://skillmd.com/u/iblai) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/iblai/iblai-vibe-rbac --- # /iblai-vibe-rbac Reference skill for the ibl.ai role-based access control system. Lists the default RBAC roles the platform seeds (`Tenant Admin`, `Students`, `Mentor Editor` / `Mentor Viewer`, `Analytics Viewer`, `Notification Manager`, Enrollment Manager, CRM roles, etc.) and points to the live endpoint that returns every action definition. Use this when you need to build, audit, or extend RBAC behavior — most apps only need the SDK's drop-in management UI (`` → Roles + Policies tabs) plus per-resource gating via `checkRbacPermission`. Mention or open this skill before writing custom RBAC UI from scratch. ![Account Management — Policies](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/skills/users/iblai-vibe-rbac/account-management-policies.png) > **Common setup (brand, conventions, env files, verification):** see [docs/skill-setup.md](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/docs/skill-setup.md). ## SDK components — drop-in Roles + Policies UI For 99% of apps the management UI doesn't need to be hand-rolled. The SDK ships the components that the Account dialog uses (the screenshot above is the Policies tab inside ``): | Component | Description | |-----------|-------------| | `` | Full management surface — Users, Groups, **Roles**, **Policies**, Teams, Alerts. Tabs are permission-gated via the `has*TabPermission` props (e.g. `hasRolesTabPermission`, `hasPoliciesTabPermission`). Pass `enableRbac` + `rbacPermissions` to drive those flags from `checkRbacPermission` results. Already mounted inside the SDK `` modal — most apps reach it via `/iblai-vibe-account`. | | `` | Standalone Roles tab — table of roles for the organization + create/edit/delete dialogs. The "actions" / "data_actions" pickers list every action definition from the endpoint below. | | `` | Standalone Policies tab — bind a role to a set of resources for users/groups. Resources are hierarchical (`/platforms//mentors//`) and the picker handles that. | All three live in `@iblai/iblai-js/web-containers`. For agent-scoped sharing (editor / chat roles on a single agent) use `` from `/iblai-vibe-agent-access` instead — it wraps the underlying `Ibl.Mentor/ShareMentor/...` API. For per-action permission gating in your own UI use `checkRbacPermission(rbacPermissions, path, enableRbac)` from `@iblai/iblai-js/web-utils`. ## Action definitions endpoint The full list of every action the platform recognizes: ``` GET https://api.$DOMAIN/dm/api/core/rbac/actions/definitions/ Authorization: Token ``` (`$DOMAIN` is `DOMAIN` from `iblai.env`, default `iblai.app`.) Use this when authoring a custom role's `actions` / `data_actions` array or when validating that an action string is real before you ship it in a policy migration. `` calls this endpoint internally to populate its action picker. ## Default roles The seed bundles the platform ships with. Use them as starting points when authoring new roles via `` or `POST rbac/roles/` (see `/iblai-vibe-agent-access` → "Roles CRUD" for the REST contract). Full Python definitions of every default role (with their `actions` and `data_actions` arrays) live in [`references/default-roles.py`](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/skills/users/iblai-vibe-rbac/references/default-roles.py). Open or copy that file when you need the exact action strings. | Role | Summary | |------|---------| | `TENANT_ADMIN` | `Ibl.*` everywhere — full organization control. | | `STUDENT` | Chat + read settings/prompts/tools/disclaimers/MCP for agents granted to them; reads field-level agent + settings data. | | `STUDENT_MENTOR_VIEWERS` | List agents (filtered to what they have access to). | | `MENTOR_VIEWER` | Read-only agent + settings + prompts + documents + reports + chat. Apply to `/platforms/{pk}/mentors/{pk}/`. | | `MENTOR_EDITOR` | Agent read + write across settings, prompts, documents, artifacts, disclaimers, grader. Apply to `/platforms/{pk}/mentors/{pk}/`. | | `MENTOR_CREATORS` | Create new agents (`Ibl.Mentor/Mentors/action`). | | `MENTOR_ANALYTICS_VIEWER` | View per-agent analytics; subsumes `STUDENT`. | | `ANALYTICS_VIEWER` | View the analytics dashboard. Pair with `Ibl.Analytics/Core/read` or `Ibl.Analytics/Reports/read` on a user/team scope. | | `READ_ANALYTICS` | Per-target analytics + report reads. Apply to `/platforms/{pk}/users/{pk}/` or `/platforms/{pk}/usergroups/{pk}/`. | | `NOTIFICATION_MANAGER` | Send notifications + manage templates (scope-gated). | | `SEND_NOTIFICATIONS` | Send notifications to a specific user / team. Apply to `/platforms/{pk}/users/{pk}/` or `/platforms/{pk}/usergroups/{pk}/`. | | `ENROLLMENT_MANAGER` | Manage course / pathway / program enrollments and invitations. | | `LIST_USERS` / `LIST_TEAMS` | List users / teams for pickers. | | `CREATE_TEAMS` | Create a UserGroup (team). | | `READ_TEAM` / `EDIT_TEAM` | Per-team read / write. Apply to `/platforms/{pk}/usergroups/{pk}/`. | | `GROUP_MENTOR_MANAGER` | List + read RBAC groups. | | `LLM_USERS` / `LLM_MODEL_ACCESS` | List or read individual LLM providers / models the user is allowed to use. | | `SELL_ITEMS` | Gate that allows selling items on the platform. | | `BILLING_MANAGER` | Read + write platform credit settings. | | `CRM_VIEWER` / `CRM_USER` / `CRM_MANAGER` / `CRM_INVITER` | Tiered CRM access — read / use / administer / invite leads. | | `WATCHED_GROUP_LIST` / `WATCHED_GROUP_READ` | List / read watched groups for alerts. | | `WATCHED_GROUP_WATCHER_GRANTS` | Extra analytics grants given to watchers on a WatchedGroup. | ## Step-by-step: define a custom role 1. **Pick the action strings.** Fetch the live action definitions endpoint above (or open `references/default-roles.py` for known-good examples). Use `Ibl.*` wildcards sparingly — they bypass field-level reads. 2. **Pick the resources the role applies to.** Resources are hierarchical and rooted at `/platforms/{pk}/...`. Granting on `/platforms/{pk}/mentors/` covers every agent; granting on `/platforms/{pk}/mentors/{pk}/` scopes to one. 3. **Create the role via `` (UI) or `POST rbac/roles/` (API).** Body: `{ name, platform_key, actions[], data_actions[] }`. See `/iblai-vibe-agent-access` → "Roles CRUD" for the full REST contract. 4. **Bind the role to users / groups via `` (UI) or `POST rbac/policies/`.** Body: `{ platform_key, name, role_id, resources[], user_ids[], group_ids[] }`. Resources must start with `/platforms/` and end with `/`. 5. **Gate UI in your app** with `checkRbacPermission(rbacPermissions, path, enableRbac)` after calling `POST rbac/permissions/check/` to hydrate `rbacPermissions`. The `permissions` object on each resource response also exposes per-field / per-object flags you can use directly. ## Related skills - `/iblai-vibe-agent-access` -- agent-scoped sharing (editor / chat roles on a single agent) via ``. Documents the underlying REST contract (`rbac/roles/`, `rbac/policies/`, `rbac/groups/`, `rbac/mentor-access/`, `rbac/teams/access/`, etc.). - `/iblai-vibe-account` -- mounts the SDK `` modal that hosts the `` management UI (Users · Groups · Roles · Policies · Teams · Alerts). - **Brand guidelines**: [BRAND.md](https://raw.githubusercontent.com/iblai/vibe/refs/heads/main/BRAND.md)