micsapp TwinMind Enterprise RBAC
Contents
Overview
Enterprise-grade role-based access control for TwinMind with SSO/SAML integration, team management, resource-level authorization, and access audit logging.
Prerequisites
- TwinMind Enterprise account
- Admin access to TwinMind organization
- Identity provider (Okta, Azure AD, Google Workspace)
- Understanding of RBAC concepts
Instructions
Step 1: Define Roles and Permissions
Create Permission enum covering transcript, summary, action item, team, settings, billing, and admin permissions. Define role hierarchy: Viewer -> Member -> Manager -> Admin -> Owner with permission inheritance via resolvePermissions().
Step 2: Implement Permission Checking
Build AuthorizationService with hasPermission(), hasAnyPermission(), hasAllPermissions() methods. Support admin wildcard, explicit deny lists, and resource-level authorization (own transcripts vs all transcripts).
Step 3: Configure SSO/SAML Integration
Set up SAML strategy with passport-saml. Map IdP attributes (email, name, groups) to TwinMind users. Configure group-to-role mapping (e.g., "TwinMind-Admins" -> admin role).
Step 4: Team Management
Build TeamManager with create team, add/remove/invite members, role updates, and sync to TwinMind organization. Enforce permission checks on team operations.
Step 5: Access Audit Logging
Create AccessAuditLogger that records all access attempts (granted and denied) with user, action, resource, IP, and user agent. Send to SIEM if configured. Add Express middleware for automatic audit trail.
See detailed implementation for complete RBAC code including Permission enum, role definitions, SSO config, team management, and audit logging.
Output
- Role and permission definitions
- Permission checking service
- SSO/SAML configuration
- Team management functionality
- Access audit logging
Error Handling
| Issue | Cause | Solution |
|---|---|---|
| SSO login failed | Certificate mismatch | Update IdP certificate |
| Role not syncing | SCIM misconfigured | Check provisioning setup |
| Permission denied | Wrong role assigned | Review role mapping |
| Audit gaps | Middleware not applied | Add to all routes |
Examples
Basic usage: Apply twinmind enterprise rbac to a standard project setup with default configuration options.
Advanced scenario: Customize twinmind enterprise rbac for production environments with multiple constraints and team-specific requirements.
Resources
Next Steps
For migration from other tools, see twinmind-migration-deep-dive.