Core ConceptAuthorization
RBAC & Permissions
Role-Based Access Control (RBAC) enables granular access gating for software features, administrative tools, and customer tiers through roles and scoped permission strings.
Permission Model
NineAuth enforces permission checks using dot-separated hierarchical strings:
features:vip_tools:read— Access to VIP analysis or toolslicenses:seats:expand— Ability to add seats to a team planadmin:audit_logs:export— Export organizational audit records
Server & Client Permission Verification
Permissions are attached to active user tokens and evaluated both during server requests and inside native client runtimes:
permission-check.ts
const session = await client.sessions.validate({ token, hwid });
if (session.hasPermission("features:vip_tools:read")) {
enableVipFeatures();
} else {
showUpgradeModal();
}