> ## Documentation Index
> Fetch the complete documentation index at: https://developers.zite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & row-level access

> Restrict who can read, create, update, or delete which records with roles and row filters in zite.permissions.json.

Declare roles and row filters once in `zite.permissions.json` at the workspace root; every app and [workflow](/framework/workflows) enforces them on every `zite.*` call. Schema → [permissions file](/framework/permissions-file); evaluation model → [Roles & permissions](/concepts/permissions).

## A practical file

Managers get full access to `Deals`; account executives can read and update only their own rows:

```json theme={null}
{
  "version": "1.0",
  "roles": [
    { "id": "sales-manager", "name": "Sales manager" },
    { "id": "account-executive", "name": "Account executive" }
  ],
  "tables": {
    "Deals": {
      "rules": [
        { "roles": ["Sales manager"], "operations": ["read", "create", "update", "delete"] },
        {
          "roles": ["Account executive"],
          "operations": ["read", "update"],
          "rowFilter": {
            "type": "comparison",
            "field": "ownerEmail",
            "operator": "eq",
            "userField": "email"
          }
        }
      ]
    }
  }
}
```

Set `defaultPolicy: "deny"` to block every table unless a rule grants access. Use the built-in **`All team members`** role to grant something to everyone internal.

## Gotchas

* **External app users bypass roles entirely.** Roles govern *internal* members on the shared database. In a public app, scope every query yourself to the signed-in user:

  ```typescript theme={null}
  // in a workflow of an external app
  execute: async ({ context }) =>
    zite.Deals.findAll({ filter: { ownerEmail: context.user.email } }),
  ```

  See [Auth](/framework/auth) and [Authentication](/concepts/authentication).
* **You define roles here; a human assigns them** on the **Members** tab. Keep each role's `id` stable across renames so assignments survive.
* **Administrators (workspace editors) bypass all rules.**