Permission matrix

Generated from commonlayer_core::authz::policy::ROLE_PERMISSIONS. platform_admin additionally holds every permission in every scope.

Platform scope

Permission	platform:user	platform:platform_admin
`platform.organizations.create`	✓	✓
`platform.projects.propose`	✓	✓
`platform.funding.contribute`	✓	✓
`platform.security_reports.submit`	✓	✓
`platform.users.read`		✓
`platform.users.manage`		✓
`platform.organizations.manage`		✓
`platform.projects.review`		✓
`platform.maintainers.approve`		✓
`platform.eligibility.override`		✓
`platform.ledger.read`		✓
`platform.ledger.adjust`		✓
`platform.payments.reconcile`		✓
`platform.payouts.initiate`		✓
`platform.payouts.approve`		✓
`platform.infrastructure.manage`		✓
`platform.security.manage`		✓
`platform.settings.manage`		✓
`platform.audit.read`		✓
`platform.jobs.manage`		✓
`platform.abuse.manage`		✓

Organization scope

Permission	organization:member	organization:billing_manager	organization:org_admin
`org.read`	✓	✓	✓
`org.members.read`	✓	✓	✓
`org.contributions.read`	✓	✓	✓
`org.contributions.create`		✓	✓
`org.contributions.manage`		✓	✓
`org.billing.read`		✓	✓
`org.billing.manage`		✓	✓
`org.update`			✓
`org.members.manage`			✓
`org.notes.read`			✓
`org.notes.write`			✓
`org.service_accounts.manage`			✓
`org.webhooks.manage`			✓
`org.delete`			✓
`org.audit.read`			✓

Project scope

Permission	project:contributor	project:security_reviewer	project:maintainer	project:project_admin
`project.contributions.submit`	✓	✓	✓	✓
`project.read_private`		✓	✓	✓
`project.security.read_private`		✓	✓	✓
`project.security.triage`		✓	✓	✓
`project.security.exceptions.request`		✓	✓	✓
`project.security.exceptions.decide`		✓	✓	✓
`project.security.advisories.manage`		✓	✓	✓
`project.update`			✓	✓
`project.artifacts.manage`			✓	✓
`project.artifacts.submit`			✓	✓
`project.releases.manage`			✓	✓
`project.tasks.manage`			✓	✓
`project.contributions.review`			✓	✓
`project.rewards.propose`			✓	✓
`project.rewards.approve`			✓	✓
`project.funding.read_private`			✓	✓
`project.audit.read`			✓	✓
`project.settings.manage`				✓
`project.members.manage`				✓
`project.maintainers.manage`				✓
`project.funding.manage`				✓
`project.sla.manage`				✓
`project.service_accounts.manage`				✓
`project.webhooks.manage`				✓

Self scope

Permission	self
`user.self.read`	✓
`user.self.manage`	✓

Human-only permissions

Service accounts never hold these, whatever role they were given; the deciding services also refuse CI workloads and system actors (Actor::require_human):

platform.maintainers.approve
platform.eligibility.override
platform.payouts.approve
platform.ledger.adjust
project.security.exceptions.decide
project.contributions.review
project.rewards.approve

Never by API token

These need an interactive session:

platform.ledger.adjust
platform.payouts.approve
platform.users.manage
platform.settings.manage