Roles & row-level access

Declare roles and row filters once in zite.permissions.json at the workspace root; every app and workflow enforces them on every zite.* call. Schema → permissions file; evaluation model → Roles & permissions.

A practical file

Managers get full access to Deals; account executives can read and update only their own rows:

{
  "version": "1.0",
  "roles": [
    { "id": "sales-manager", "name": "Sales manager" },
    { "id": "account-executive", "name": "Account executive" }
  ],
  "tables": {
    "Deals": {
      "rules": [
        { "roles": ["Sales manager"], "operations": ["read", "create", "update", "delete"] },
        {
          "roles": ["Account executive"],
          "operations": ["read", "update"],
          "rowFilter": {
            "type": "comparison",
            "field": "ownerEmail",
            "operator": "eq",
            "userField": "email"
          }
        }
      ]
    }
  }
}

Set defaultPolicy: "deny" to block every table unless a rule grants access. Use the built-in All team members role to grant something to everyone internal.

Gotchas

External app users bypass roles entirely. Roles govern internal members on the shared database. In a public app, scope every query yourself to the signed-in user:
// in a workflow of an external app execute: async ({ context }) => zite.Deals.findAll({ filter: { ownerEmail: context.user.email } }),
See Auth and Authentication.
You define roles here; a human assigns them on the Members tab. Keep each role’s id stable across renames so assignments survive.
Administrators (workspace editors) bypass all rules.

Get started

Core concepts

Build with agents

Zite.js framework

Tutorials

Recipes

Deploy

Resources

Roles & row-level access

A practical file

Gotchas

​A practical file

​Gotchas

A practical file

Gotchas