Stage 3: permissions.toml.example (RBAC-Policy-Vorlage)

2026-06-24 08:01:05 +00:00
parent 8c38808d12
commit 8f41215a8f
1 changed files with 32 additions and 0 deletions
@@ -0,0 +1,32 @@
+# Beispiel-RBAC-Policy.
+#
+# Aktivieren: diese Datei nach ./data/permissions.toml kopieren, echte Tokens
+# eintragen und in der .env `DTRACK_PERMISSIONS=/data/permissions.toml` setzen.
+# Dann gilt RBAC statt der flachen DTRACK_HTTP_TOKENS-Liste.
+#
+# Semantik: "*" in allow = alle Tools. deny schlaegt allow.
+
+# --- Rollen ---
+[[roles]]
+name  = "full"
+allow = ["*"]
+
+[[roles]]
+name  = "metrics-only"
+allow = ["list_projects", "project_metrics"]
+
+[[roles]]
+name  = "no-findings"
+allow = ["*"]
+deny  = ["project_findings"]
+
+# --- Clients: Bearer-Token -> Rolle ---
+[[clients]]
+name  = "claude-desktop"
+token = "GEHEIMEN-TOKEN-HIER-SETZEN"
+role  = "full"
+
+[[clients]]
+name  = "dashboard-bot"
+token = "ANDERER-GEHEIMER-TOKEN"
+role  = "metrics-only"