Permissions & Authorization⚓︎

This document defines the atomic capabilities and Role Groups that drive the DMS authorization engine. For the underlying trust principles and identity boundaries, see Roles.

Permission Model⚓︎

DMS uses an Additive Permission Model. A User's total capability within a Topic is the sum of all permissions granted by their assigned Role Group.

Naming Convention⚓︎

entity.action (e.g., topic.edit, decision.make)

Core Permissions Reference⚓︎

Select an entity to view the specific permissions associated with it.

Topic Choice & Reason Decision Learning

Permission	Capability
`topic.read`	The Gateway: View the Topic and all nested data
`topic.edit`	Modify metadata (title, context, tags)
`topic.archive`	Move Topic to an inactive state
`topic.reopen`	Restore an archived Topic to active status
`topic.assign_role`	Manage User roles and permissions

Permission	Capability
`choice.add`	Propose a new option for consideration
`choice.remove`	Retract a proposed option (Soft-delete only)
`choice.status.change`	Mark choice as dismissed or preferred
`reason.add`	Attach rationale to a specific choice

Permission	Capability
`decision.make`	Commit to a choice and finalize the Topic

Permission	Capability
`review.add`	Record outcomes after a decision is executed
`lesson.add`	Extract and formalize a learning point
`note.add`	Add general comments or contextual notes

Role Group Definitions⚓︎

Role Groups are technical bundles. They are mapped to the semantic Roles (Owner, Advisor, etc.) defined in the Roles documentation.

Permission	Owner	Advisor	Reviewer	Observer
`topic.read`
`topic.edit`
`topic.archive`
`topic.assign_role`
`choice.add`
`reason.add`
`decision.make`
`review.add`
`lesson.add`
`note.add`
---

Authorization Rules⚓︎

Evaluation Logic

Gateway Rule: Assignment to a Topic Role automatically triggers the topic.read permission check.
Topic Isolation: Permissions are scoped to a single Topic ID. There are no "Global" domain permissions.
Immutability: No permission exists that allows the deletion of a Record from the Decision Memory once it has been authored.

Future Considerations⚓︎

Temporary grants (Time-limited access for external advisors)
Delegation (Allowing an Owner to delegate decision.make rights)