# Permission System — Ninja Nexus

## Model: RBAC med fine-grained permissions

```
Bruger → Rolle(r) → Permissions → Ressourcer
```

---

## Foruddefinerede roller

| Rolle | Beskrivelse | Typisk bruger |
|-------|-------------|---------------|
| **Super Admin** | Fuld adgang, tenant management | Platform-ejer |
| **Admin** | Fuld adgang inden for organisation | IT-chef |
| **Device Admin** | Enheder, politikker, compliance | IT-drift |
| **App Admin** | App Center, deployment | Application manager |
| **Support** | Remote support, read-only enheder | Helpdesk |
| **User** | Ingen admin-adgang | Medarbejder |

---

## Permission Format

```
{module}.{resource}.{action}

Eksempler:
  identity.users.read
  identity.users.write
  identity.users.delete
  identity.roles.assign
  devices.inventory.read
  devices.policies.write
  devices.policies.assign
  devices.remote_wipe
  apps.catalog.read
  apps.catalog.publish
  apps.deployments.create
  support.sessions.create
  support.sessions.view_recording
  admin.audit.read
  admin.audit.export
  admin.settings.write
  admin.tenants.manage
```

---

## Permission Matrix (uddrag)

| Permission | Super Admin | Admin | Device Admin | App Admin | Support | User |
|------------|:-----------:|:-----:|:------------:|:---------:|:-------:|:----:|
| identity.users.read | ✅ | ✅ | ❌ | ❌ | 🟡 | ❌ |
| identity.users.write | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| devices.policies.write | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
| devices.remote_wipe | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ |
| apps.catalog.publish | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ |
| apps.deployments.create | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ |
| support.sessions.create | ✅ | ✅ | ❌ | ❌ | ✅ | ❌ |
| admin.audit.read | ✅ | ✅ | 🟡 | ❌ | ❌ | ❌ |
| admin.tenants.manage | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |

🟡 = Begrænset (egen org / seneste 30 dage)

---

## Custom Roller

Admin kan oprette custom roller:

1. Vælg permissions fra matrix
2. Navngiv rolle (f.eks. "Regional IT")
3. Tildel til brugere eller grupper
4. Custom roller kan ikke eskalere over Admin-niveau

---

## Enforcement

| Lag | Enforcement |
|-----|-------------|
| API Gateway | JWT claims → permission check middleware |
| Backend services | Decorator/attribute på endpoints |
| Control Center UI | Skjul elementer bruger ikke har adgang til |
| Agent | Modtager kun kommandoer matching device policies |
| Shell | Ingen admin-funktioner |

---

## Separation of Duties

| Regel | Begrundelse |
|-------|-------------|
| Support kan ikke ændre politikker | Forhindre privilege escalation |
| App Admin kan ikke remote wipe | Begræns destruktive handlinger |
| Device Admin kan ikke se audit export | Privacy og segregation |
| Super Admin handlinger kræver MFA step-up | Beskyttelse af højeste privilegium |

---

*Se også: [SECURITY_MODEL.md](./SECURITY_MODEL.md) · [modules/IDENTITY.md](../modules/IDENTITY.md)*
