Permissions & identity.
wrxstack uses a single permission model across every module. There is no per-tool ACL drift, no per-doc share dialog, no folder permissions to forget about. Permissions live on the graph and the graph is the only place to grant them.
- The role hierarchy and what each role can do
- How permissions inherit along edges
- The difference between user, group, and service-account identities
- How the assistant inherits permission from its caller
Roles
Four built-in roles. Custom roles are available on Business and Enterprise plans.
| Role | Read | Write | Admin |
|---|---|---|---|
guest | explicit only | none | none |
member | workspace | own + assigned | none |
lead | workspace | own + team | policy on team |
admin | workspace | workspace | all |
Guests are the right default for vendors and contractors. Don't give a guest member just to grant a single doc; share the doc explicitly. The audit log surfaces every guest access as a separate row.
Edges carry permission
The work graph models permission as a derived property of edges. If a user can read an account, they can read every node connected to it via an about edge unless that edge is marked private.
This is why we recommend modeling new node types as connected to a parent rather than free-floating. Make a new Briefing node? Connect it about an account and the right people see it for free.
Users, groups, and service accounts
Three identity kinds:
- Users are humans. Authenticated via SSO. See SSO with Okta.
- Groups are sets of users. Sync from IdP or define locally. Use them in workflow scopes instead of individual users.
- Service accounts are machine identities. Created from Settings → API keys. Each ships its own audit lane so machine actions don't dilute the human audit log.
How the assistant inherits permission
An assistant invocation always runs under the union of (the calling user's scope) ∩ (the workflow's declared scope). A workflow can never elevate. If your workflow declares write:contracts but the invoking user only has read, the write tool is removed from the assistant's tool list for that run.
The audit log records the effective scope for every run. If you see a missing tool call, this is the first place to check.