Roles & permissions

Reloqui uses additive, org- and project-scoped roles. Higher roles imply lower ones.

Roles

Role	Scope	Can
org_admin	Org	Everything in the org; implies all project roles. Manage SSO, retention, GDPR, tokens, members.
project_admin	Project	Manage catalog, integrations, members, settings.
release_manager	Project	Create/reconcile/publish releases; request approvals; curate evidence.
governance_admin	Project	Own policies, freeze windows and approvals (without full project-admin). Implies release_manager + member.
project_member	Project	Read and contribute within a project.
executive_viewer	Project	High-level read; evidence detail is trimmed (no commit SHAs/actors).
demo_viewer	Org	Full read of the public demo; every write returns 403 DEMO_READ_ONLY.

How enforcement works

• Every request carries a Principal with org and per-project roles.
• Endpoints call require(role) / require_any(...); higher roles satisfy lower requirements.
• Row-level security in PostgreSQL is the second layer — queries fail closed if the tenant context is unset.

Token scopes (service principals)

Automation uses rat_… tokens with scopes instead of user roles:

releases:read · releases:write · catalog:read · catalog:write · scim

Tokens can be project- or org-scoped. See Admin guide.