Permission

A permission is a named set of resource endpoints. It is the unit roles and clients use to describe what they may call — neither ever lists endpoints directly. For the conceptual picture, see Entities.

• Permission ID — lowercase segments separated by . or :, each starting with a letter (e.g. orders.read, orders:write:managed).
• Description — a label shown in the admin console.
• Endpoints — the set of resource endpoints this permission covers, picked from one or more resources in the tenant.

Permissions reach edge’s authorization check through two different paths:

• Via a role — a user holding a role that includes the permission can call any endpoint it covers, subject to that endpoint’s own allow expression.
• Directly on a client — for the client_credentials grant, where there is no user, the client’s own permissions determine what it may call in its own name.

→ How to register a permission