diff --git a/permissions.toml.example b/permissions.toml.example
new file mode 100644
index 0000000..8678ac7
--- /dev/null
+++ b/permissions.toml.example
@@ -0,0 +1,32 @@
+# Beispiel-RBAC-Policy.
+#
+# Aktivieren: diese Datei nach ./data/permissions.toml kopieren, echte Tokens
+# eintragen und in der .env `DTRACK_PERMISSIONS=/data/permissions.toml` setzen.
+# Dann gilt RBAC statt der flachen DTRACK_HTTP_TOKENS-Liste.
+#
+# Semantik: "*" in allow = alle Tools. deny schlaegt allow.
+
+# --- Rollen ---
+[[roles]]
+name  = "full"
+allow = ["*"]
+
+[[roles]]
+name  = "metrics-only"
+allow = ["list_projects", "project_metrics"]
+
+[[roles]]
+name  = "no-findings"
+allow = ["*"]
+deny  = ["project_findings"]
+
+# --- Clients: Bearer-Token -> Rolle ---
+[[clients]]
+name  = "claude-desktop"
+token = "GEHEIMEN-TOKEN-HIER-SETZEN"
+role  = "full"
+
+[[clients]]
+name  = "dashboard-bot"
+token = "ANDERER-GEHEIMER-TOKEN"
+role  = "metrics-only"