Rollen & Berechtigungen
PIE autorisiert jede Operation über sechs Rollen. Der Zugriff wird serverseitig von der RBAC-Engine durchgesetzt (can(principal, action, resource)); der clientseitige Hook usePermission() dient nur der Oberfläche. Für Einkäufer-Rollen schränkt zusätzlich ein Freigabefilter (queryFilter.grantedOrgIds) Lesezugriffe auf Hersteller ein, die eine Freigabe erteilt haben — einige Ressourcen (z. B. quality_profile) sind bewusst auf die eigene Organisation beschränkt.
Jede Zelle nennt die Aktionen, die die Rolle auf der Ressource ausführen darf; — bedeutet kein Zugriff.
| Ressource | pip_admin | pip_editor | pip_viewer | pic_subscriber | pic_admin | platform_admin | platform_admin_readonly | platform_support | platform_billing |
|---|---|---|---|---|---|---|---|---|---|
ai_enrichment | read, create, accept, reject | read, create, accept, reject | read | — | — | read | read | read | — |
ai_settings | read, update | — | — | — | read, update | read, update | read | read | — |
analytics | read, export | read, export | read, export | — | — | read | read | read | — |
api_key | read, create, delete, manage_api_keys | — | — | — | read, create, delete, manage_api_keys | read, delete | read | read | — |
audit_log | read, view_audit | — | — | — | read, view_audit | read, view_audit | read, view_audit | read, view_audit | — |
auth_policy | read, update | — | — | — | read, update | — | — | — | — |
billing | read, create | — | — | — | read, create | read, create, update, delete | read | — | read, create, update, delete |
brand_portal | read, create, update, delete, publish | read | read | — | — | read | read | read | — |
catalog_render | read, create | read, create | read | — | — | read | read | read | — |
catalog_template | read, create, update, delete | read, create, update, delete | read | — | — | read | read | read | — |
channel | read, create, update, delete | read | read | — | — | read | read | read | — |
channel_publication | read, publish | read, publish | read | — | — | read | read | read | — |
connector | read, create, update, delete, test | read | read | — | — | read | read | read | — |
consent | read, update | — | — | — | read, update | read | read | read | — |
data_subject_request | read, create | — | — | — | read, create | read, create | read | read, create | — |
gdsn_connection | read, create, update, delete | read | read | — | — | read | read | read | — |
gdsn_inbound | — | — | — | read, accept, reject | read, accept, reject | read | read | read | — |
gdsn_message | read | read | read | — | — | read | read | read | — |
gdsn_publication | read, create | read, create | read | — | — | read | read | read | — |
grant | read, create, delete, manage_grants | read | read | read | read | read, create, delete, manage_grants | read | read | — |
gs1_mapping | read, create, update, delete | read | read | — | — | read | read | read | — |
impersonation | — | — | — | — | — | create | — | create | — |
mapping_template | — | — | — | read | read, create, update, delete | read | read | read | — |
onboarding_request | — | — | — | read | read, create, update, delete | read | read | read | — |
onboarding_submission | — | — | — | read | read, update, approve, reject | read | read | read | — |
org | read, update | read | read | read | read, update | read, create, update, delete | read | read | read |
platform_admin_users | — | — | — | — | — | read, create, update, delete, manage_users | — | — | — |
platform_email | — | — | — | — | — | create | — | — | — |
processing_record | read, create, update, delete | — | — | — | read, create, update, delete | read | read | read | — |
product | read, create, update, delete, publish, archive | read, create, update, publish | read | read | read | read | read | read | — |
product_asset | read, create, update, delete | read, create, update, delete | read | read | read | read | read | read | — |
product_category | read, create, update, delete | read | read | read | read | read | read | read | — |
product_passport | read, create, update, delete, publish, submit, export | read, create, update, delete, publish, export | read, export | — | — | read | read | read | — |
product_relationship | read, create, update, delete | read, create, update, delete | read | read | read | read | read | read | — |
quality_profile | read, create, update, delete | read | read | read | read, create, update, delete | read | read | read | — |
reference_entity | read, create, update, delete | read, create, update, delete | read | read | read | read | read | read | — |
reference_entity_type | read, create, update, delete | read | read | read | read | read, create, update, delete | read | read | — |
registry_credentials | read, update | — | — | — | — | read | read | read | — |
rendition_preset | read, create, update, delete | read | read | — | — | read | read | read | — |
retention_policy | read, create, update, delete | — | — | — | read, create, update, delete | read, create, update, delete | read | read | — |
sso_connection | read, create, update, delete, test | — | — | — | read, create, update, delete, test | read | read | — | — |
tenant_assist | — | — | — | — | — | create | — | create | — |
user | read, create, update, delete, manage_users | read | read | read | read, create, update, delete, manage_users | read, create, update, delete, manage_users | read | read | — |
webhook | read, create, update, delete | read | — | read, create, update, delete | read, create, update, delete | read | read | read | — |
workflow | read, create, update, delete | read | read | — | — | read | read | read | — |
workflow_instance | read, update | read, update | read | — | — | read | read | read | — |