---
# System prepended metadata

title: Authorization RBAC

---

# Authorization RBAC

## Actor / Subject / Cloud Wallet

`urn:trinsic:cloudwallet:1234567890` - URI
`urn:uuid:{guid}`
`https://{guid}`

Actor can have multiple keys on multiple devices

Device #1 - Phone
`did:key:device1` (controller)
`did:key:device1#key-1` (authentication)

Device #2 - Browser
`did:key:device2` (controller)
`did:key:device2#key-1` (authentication)


## Role Assignment

RoleId + Actor + Scope (Resource)

`trinsic.roles/issuer` + `urn:trinsic:cloudwallet:1234567890` + ??

## Roles

Roles are groups of permissions

Issuer = `trinsic.roles/issuer`
Provider = `trinsic.roles/provider`
Onboarding Manager 
  `TrustRegistry.Schemas.Read`
  `TrustRegistry.PEx.Read`
Template Manager = `trinsic.roles/template_manager`
  `TrustRegistry.Schemas.Read`
  `TrustRegistry.Schemas.Write`
  `TrustRegistry.PEx.Write`
  `TrustRegistry.PEx.Read`

### Permissions

`TrustRegistry.Schemas.Read`
`TrustRegistry.Schemas.Write`
`TrustRegistry.PEx.Write`
`TrustRegistry.PEx.Read`
....


## Scopes (Resources)

Ecosystem `/ecosystems/123`
Ecosystem Metadata `/ecosystem/123/metadata`
Cloud Wallets `/ecosystem/123/wallets/456`
Trust Registry `/ecosystem/123/trust_registry`


### Endpoint

TrustRegistryManager_Policy
CloudWallet_AccessPolicy
  Search
  Insert Record
  Issue
  Verify
  Send
  
### Example of Role Defitions used in Azure

![](https://i.imgur.com/zE2Hnur.png)
