# Beispiel-RBAC-Policy.
#
# Aktivieren: diese Datei nach ./data/permissions.toml kopieren, echte Tokens
# eintragen und in der .env `DTRACK_PERMISSIONS=/data/permissions.toml` setzen.
# Dann gilt RBAC statt der flachen DTRACK_HTTP_TOKENS-Liste.
#
# Semantik: "*" in allow = alle Tools. deny schlaegt allow.

# --- Rollen ---
[[roles]]
name  = "full"
allow = ["*"]

[[roles]]
name  = "metrics-only"
allow = ["list_projects", "project_metrics"]

[[roles]]
name  = "no-findings"
allow = ["*"]
deny  = ["project_findings"]

# --- Clients: Bearer-Token -> Rolle ---
[[clients]]
name  = "claude-desktop"
token = "GEHEIMEN-TOKEN-HIER-SETZEN"
role  = "full"

[[clients]]
name  = "dashboard-bot"
token = "ANDERER-GEHEIMER-TOKEN"
role  = "metrics-only"