From 8f41215a8f998b689cce762ff26620721ca3fc43 Mon Sep 17 00:00:00 2001
From: Sebas <claude.these371@passmail.net>
Date: Wed, 24 Jun 2026 08:01:05 +0000
Subject: [PATCH] Stage 3: permissions.toml.example (RBAC-Policy-Vorlage)

---
 permissions.toml.example | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 permissions.toml.example

diff --git a/permissions.toml.example b/permissions.toml.example
new file mode 100644
index 0000000..8678ac7
--- /dev/null
+++ b/permissions.toml.example
@@ -0,0 +1,32 @@
+# Beispiel-RBAC-Policy.
+#
+# Aktivieren: diese Datei nach ./data/permissions.toml kopieren, echte Tokens
+# eintragen und in der .env `DTRACK_PERMISSIONS=/data/permissions.toml` setzen.
+# Dann gilt RBAC statt der flachen DTRACK_HTTP_TOKENS-Liste.
+#
+# Semantik: "*" in allow = alle Tools. deny schlaegt allow.
+
+# --- Rollen ---
+[[roles]]
+name  = "full"
+allow = ["*"]
+
+[[roles]]
+name  = "metrics-only"
+allow = ["list_projects", "project_metrics"]
+
+[[roles]]
+name  = "no-findings"
+allow = ["*"]
+deny  = ["project_findings"]
+
+# --- Clients: Bearer-Token -> Rolle ---
+[[clients]]
+name  = "claude-desktop"
+token = "GEHEIMEN-TOKEN-HIER-SETZEN"
+role  = "full"
+
+[[clients]]
+name  = "dashboard-bot"
+token = "ANDERER-GEHEIMER-TOKEN"
+role  = "metrics-only"