DocsTrust network

Permissions in Community OS

What a permission is, how permission names are built, and how admin roles map to permissions.

ReferenceTrust networkAdminBeneficiaryCoordinatorFamilySupport workerTrusteeUpdated 2026-08-25

This reference explains the permission vocabulary. A permission names what one thing an account can do with one kind of record. Use it to understand why an account can or cannot take an action.

Overview

Community OS protects records with permissions. Every request to read or change a record is checked against the permissions of the account that makes the request. If the account does not have the right permission, the request is refused.

A permission name

A permission name has three parts: the domain, the entity, and the action. They are joined with periods, like crm.person_record.read.

A permission name
Part	What it names	Example
Domain	The product area that holds the records.	`crm` for community CRM, `events` for events, `support` for support plans and arrangements.
Entity	The kind of record within the domain.	`person_record`, `public_event`, `support_plan`.
Action	What the account can do with the record: `read` or `write`.	`read` to view, `write` to view and change.

The action follows the request method. Reading methods map to read. Changing methods map to write.

A permission name
Request method	Action
GET (and HEAD)	`read`
POST, PUT, PATCH, DELETE	`write`

Wildcards

A permission can cover more than one domain or entity. Wildcards make this shorter.

Wildcards
Pattern	Meaning
`*`	Everything. All domains, all entities, all actions.
`admin`	The admin scope for the whole system. Implied for an EmDash Admin.
`{domain}.*`	All entities and actions in one domain, for example `platform.*`.

EmDash roles and suggested permissions

An EmDash user role maps to suggested domain permissions. This is guidance for setting up accounts, not a hard rule.

EmDash roles and suggested permissions
EmDash role	Role level	Suggested domain permissions
Admin	50	All domains, all actions. Shown as `*` or `admin`.
Editor	40	Read and write on content domains, such as CRM, events, RSVP, consultations, directory, and feedback.
Reader or Subscriber	Below 40	Read only. List and search on public content domains.

When access is refused

When an account asks to do something its permissions do not cover, the system refuses the request with a 403 status and the error code INSUFFICIENT_SCOPE. For the person using the site, this shows as a message such as "you cannot do that" or "you cannot open the record".

Permissions and the trust network

The trust network uses the same permission vocabulary for the machine accounts that manage records. The record-scoped rules in the trust network still apply on top of permissions. A support worker needs the permission to read a support plan, an active support arrangement, and an active consent from the beneficiary. Read What is consent to understand how consent works with permissions.