Access control
Roles & Policies
Role policy compiles to Cedar — default-deny. Individual grants override it, audited and time-boxed.
read-only
16allowed
2grants
49default-deny of 65
Set what each role may call. Nothing is written until you save.
| Action | Contractor | Engineer | Engineering Manager | Senior Engineer | Support |
|---|---|---|---|---|---|
github_list_repos | |||||
github_create_issue | |||||
slack_read_messages | |||||
slack_post_message | |||||
allowed by roleindividual granttemporarydefault-deny — the normal postureActions discovered from MCP servers arrive here default-deny.