bknd-create-role_skill

Overview

This skill helps you define and manage roles in the Bknd authorization system. It covers role properties (implicit_allow, is_default, permissions), permission assignment formats (allow/deny), role hierarchies, and common role patterns like admin, editor, viewer, and anonymous. Use it to design predictable access models and seed roles for registration or administration.

How this skill works

Roles are declared in code mode inside the auth.guard configuration. Each role can set implicit_allow (global allow unless denied), is_default (applied to unauthenticated users), and an array of permissions or permission objects with effect: allow/deny. The guard must be enabled for roles to be enforced. You assign roles at registration, user creation seeds, or by updating the user record.

When to use it

• Creating new roles or editing permissions (code mode required)
• Setting the default role for unauthenticated users
• Seeding admin or initial users with specific roles
• Modeling multi-tier access (admin, editor, contributor, anonymous)
• Restricting public access in closed systems

Best practices

• Always enable guard: auth.guard.enabled must be true for roles to work
• Use implicit_allow: false for all non-admin roles to avoid accidental grants
• Set only one is_default role to avoid unpredictable behavior
• Define roles before referencing them in default_role_register or seeding
• Limit raw database permissions (data.raw.*) to fully trusted roles

Example use cases

• Admin role with implicit_allow: true for full system control
• Editor role granting create/read/update but not delete
• Anonymous default role granting read-only access to public resources
• API client role that can create and read but not modify or delete
• Closed system where allow_register is false and no default role exists