Rôles et autorisations

PIE autorise chaque opération via six rôles. L'accès est appliqué côté serveur par le moteur RBAC (can(principal, action, resource)) ; le hook client usePermission() ne sert qu'à l'interface. Pour les rôles acheteur, un filtre d'accord (queryFilter.grantedOrgIds) restreint en outre les lectures aux producteurs ayant accordé l'accès — quelques ressources (par ex. quality_profile) sont délibérément limitées à la propre organisation.

Chaque cellule indique les actions que le rôle peut effectuer sur la ressource ; — signifie aucun accès.

Ressource	`pip_admin`	`pip_editor`	`pip_viewer`	`pic_subscriber`	`pic_admin`	`platform_admin`	`platform_admin_readonly`	`platform_support`	`platform_billing`
`ai_enrichment`	read, create, accept, reject	read, create, accept, reject	read	—	—	read	read	read	—
`ai_settings`	read, update	—	—	—	read, update	read, update	read	read	—
`analytics`	read, export	read, export	read, export	—	—	read	read	read	—
`api_key`	read, create, delete, manage_api_keys	—	—	—	read, create, delete, manage_api_keys	read, delete	read	read	—
`audit_log`	read, view_audit	—	—	—	read, view_audit	read, view_audit	read, view_audit	read, view_audit	—
`auth_policy`	read, update	—	—	—	read, update	—	—	—	—
`billing`	read, create	—	—	—	read, create	read, create, update, delete	read	—	read, create, update, delete
`brand_portal`	read, create, update, delete, publish	read	read	—	—	read	read	read	—
`catalog_render`	read, create	read, create	read	—	—	read	read	read	—
`catalog_template`	read, create, update, delete	read, create, update, delete	read	—	—	read	read	read	—
`channel`	read, create, update, delete	read	read	—	—	read	read	read	—
`channel_publication`	read, publish	read, publish	read	—	—	read	read	read	—
`connector`	read, create, update, delete, test	read	read	—	—	read	read	read	—
`consent`	read, update	—	—	—	read, update	read	read	read	—
`data_subject_request`	read, create	—	—	—	read, create	read, create	read	read, create	—
`gdsn_connection`	read, create, update, delete	read	read	—	—	read	read	read	—
`gdsn_inbound`	—	—	—	read, accept, reject	read, accept, reject	read	read	read	—
`gdsn_message`	read	read	read	—	—	read	read	read	—
`gdsn_publication`	read, create	read, create	read	—	—	read	read	read	—
`grant`	read, create, delete, manage_grants	read	read	read	read	read, create, delete, manage_grants	read	read	—
`gs1_mapping`	read, create, update, delete	read	read	—	—	read	read	read	—
`impersonation`	—	—	—	—	—	create	—	create	—
`mapping_template`	—	—	—	read	read, create, update, delete	read	read	read	—
`onboarding_request`	—	—	—	read	read, create, update, delete	read	read	read	—
`onboarding_submission`	—	—	—	read	read, update, approve, reject	read	read	read	—
`org`	read, update	read	read	read	read, update	read, create, update, delete	read	read	read
`platform_admin_users`	—	—	—	—	—	read, create, update, delete, manage_users	—	—	—
`platform_email`	—	—	—	—	—	create	—	—	—
`processing_record`	read, create, update, delete	—	—	—	read, create, update, delete	read	read	read	—
`product`	read, create, update, delete, publish, archive	read, create, update, publish	read	read	read	read	read	read	—
`product_asset`	read, create, update, delete	read, create, update, delete	read	read	read	read	read	read	—
`product_category`	read, create, update, delete	read	read	read	read	read	read	read	—
`product_passport`	read, create, update, delete, publish, submit, export	read, create, update, delete, publish, export	read, export	—	—	read	read	read	—
`product_relationship`	read, create, update, delete	read, create, update, delete	read	read	read	read	read	read	—
`quality_profile`	read, create, update, delete	read	read	read	read, create, update, delete	read	read	read	—
`reference_entity`	read, create, update, delete	read, create, update, delete	read	read	read	read	read	read	—
`reference_entity_type`	read, create, update, delete	read	read	read	read	read, create, update, delete	read	read	—
`registry_credentials`	read, update	—	—	—	—	read	read	read	—
`rendition_preset`	read, create, update, delete	read	read	—	—	read	read	read	—
`retention_policy`	read, create, update, delete	—	—	—	read, create, update, delete	read, create, update, delete	read	read	—
`sso_connection`	read, create, update, delete, test	—	—	—	read, create, update, delete, test	read	read	—	—
`tenant_assist`	—	—	—	—	—	create	—	create	—
`user`	read, create, update, delete, manage_users	read	read	read	read, create, update, delete, manage_users	read, create, update, delete, manage_users	read	read	—
`webhook`	read, create, update, delete	read	—	read, create, update, delete	read, create, update, delete	read	read	read	—
`workflow`	read, create, update, delete	read	read	—	—	read	read	read	—
`workflow_instance`	read, update	read, update	read	—	—	read	read	read	—