Role-based access control (RBAC)

Role-based access control grants permissions by role rather than by person: everyone holding a given role gets the same set of permissions, so access is reasoned about, and audited, at the level of a small number of roles instead of a long list of individual grants that drift over time.

A regulated organization needs to be able to show who could do what, and role-based grants make that answerable directly: list the people in a role, and you know what they could all do, without inspecting every account one by one.

Only an admin role can invite a new member or change another member's role, while every role, including the most basic one, can view usage and create access keys for calling deployed resources.

In Dynamiq, every organization member holds one role, Owner, Admin or Member, and management actions such as inviting members or changing roles require Owner or Admin. Every API request is authorized by walking the resource's project and organization membership before anything is returned, so a private project stays invisible to anyone outside it, regardless of what they might otherwise be able to see.