Skip to content

Permissions

DMS uses an ACL model with entries in the form resource:action. Each entry is granted to a user or a security group and can be allow or deny.

Rules

  • A user receives entries directly and through group membership.
  • Deny overrides allow.
  • Wildcards are supported: resource:*, *:action, and *:*.
  • *:* is the superadmin grant.
  • The rol field on a user is a display/legacy value, not the permission source.

Roles are not inherited

DMS does not implement roles as permission containers that inherit from other roles. The Roles and permissions page is an ACL matrix. Use security groups for shared access.

UI and API

The page guards and the API both enforce permissions. Some list endpoints are broader than the page that uses them, and some actions are enforced without appearing in the ACL UI. If an action is missing from the matrix but still required, ask your administrator or support.

Known limitations

A few enforced actions may not be exposed in the ACL screen yet. In practice they can be limited to the superadmin grant. Review the effective permissions with your administrator before relying on them.