Roles and permissions

A permission is a key such as finance.invoices.approve. A role is a named set of keys. A role template is the starting set a new organisation is founded with.

Two guards exist and they answer different questions. One asks whether the signed-in person holds a key inside this organisation. The other asks whether they administer the platform itself, which is not an organisation role and cannot be granted from inside one.