---
path: /studio/yemaya/rbac
surface: studio
domain: yemaya
auth: signed-in + studio entitlement
source: apps/oshun/web/src/app/studio/yemaya/rbac/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; live
  screen-reader, touch, offline, and telemetry-delivery checks pending a manual
  AT pass. Evidence: WALKTHROUGH/results/runtime-sweep-2026-05-29.md; body
  re-derived 2026-06-03 from current source (lane-console architecture)'
---

# Studio · Yemaya · RBAC

## Purpose

Admin lane console for role-permission resolution. It wires the real
`@yemaya/rbac` role-permission engine via `/v1/admin/yemaya/rbac`: browse the
built-in role templates and check whether a role holds a permission, with
transitive `inherits` chains resolved into the role's effective permissions.

## Entry points

- Breadcrumb chain on this page: **Studio › Yemaya Auth › RBAC**.
- Reachable from the Studio index and from sibling Yemaya routes; also embedded
  as the RBAC Lane inside the Auth and Organizations aggregators.
- Direct URL / bookmark (signed-in + studio entitlement).

## Layout regions

`page.tsx` renders `ShellLayout active="studio"` and:

- **Breadcrumbs panel** (`data-yemaya-rbac-breadcrumbs`): Studio › Yemaya Auth ›
  RBAC.
- **Workspace panel** (`StudioYemayaRbacWorkspace`,
  `data-yemaya-rbac-workspace`):
  - `<h1>` "Yemaya RBAC Workspace" (`WorkspaceHeading`).
  - Summary paragraph (`data-yemaya-rbac-summary`).
  - The permission-check form lane (loading / unauthorized / error / ready-form /
    result, see States); `data-yemaya-rbac-templates` lists the built-in role
    template names.
- **Route Map panel** (`data-yemaya-rbac-route-map`): `<h2>` "Route Map" + six
  `STUDIO_YEMAYA_RBAC_ROUTE_MAP` entries.
- **Quick-action panel**: four `quickAction` links.

## States

- [ ] **Loading** — `data-yemaya-rbac-loading` "Loading RBAC engine…" while the
      GET catalog fetch is in flight.
- [ ] **Unauthorized** — `data-yemaya-rbac-unauthorized` "Access restricted." on a
      401/403 admin-scope failure (fail-closed).
- [ ] **Error** — `data-yemaya-rbac-error` "Could not load RBAC." on a non-OK /
      malformed catalog response.
- [ ] **Ready-form** — `data-yemaya-rbac-check-form` once the catalog
      (`builtInTemplates`) resolves.
- [ ] **Result** — `data-yemaya-rbac-result` with `data-yemaya-rbac-verdict`
      (granted / denied) and `data-yemaya-rbac-effective` (effective
      permissions); or a validation message `data-yemaya-rbac-check-error`.

## Interactions

### Breadcrumbs

- [ ] **"Studio"** (link) → `/studio`
- [ ] **"Yemaya Auth"** (link) → `/studio/yemaya/auth`
- [ ] **"RBAC"** (current page) — `aria-current="page"`.

### Permission-check form (`data-yemaya-rbac-check-form`)

- [ ] **Role definitions (JSON)** — `textarea` `data-yemaya-rbac-field-roles`
      (aria-label "role definitions json"); JSON array of
      `{ name, permissions[], inherits? }`.
- [ ] **Role** — `input` `data-yemaya-rbac-field-rolename` (aria-label "role
      name").
- [ ] **Permission** — `input` `data-yemaya-rbac-field-permission` (aria-label
      "permission").
- [ ] **Submit** — `button` `data-yemaya-rbac-check-submit` "Check permission" →
      POST `/v1/admin/yemaya/rbac/check` with `{ roles, roleName, permission }`.

### Route map

`data-yemaya-rbac-route-map` — six entries:

- [ ] `/studio/yemaya/rbac`
- [ ] `/studio/yemaya/rbac/scenes/[sceneId]`
- [ ] `/studio/yemaya/rbac/exports/[exportId]`
- [ ] `/studio/yemaya/rbac/revisions/[revisionId]`
- [ ] `/studio/yemaya/rbac/parity/[parityId]`
- [ ] `/studio/yemaya/rbac/governance/[policyId]`

### Quick actions

- [ ] **"Open Yemaya Auth workspace"** → `/studio/yemaya/auth`.
- [ ] **"Open Yemaya Enterprise Plans workspace"** →
      `/studio/yemaya/enterprise-plans`.
- [ ] **"Open Yemaya Compliance and Audit workspace"** →
      `/studio/yemaya/compliance-and-audit`.
- [ ] **"Back to Studio workspace index"** → `/studio`.

## Data & contracts

- **Reads**: GET `/v1/admin/yemaya/rbac` (catalog: `builtInTemplates`) on mount.
- **Writes**: POST `/v1/admin/yemaya/rbac/check`.
- **Realtime**: none.
- **Caching**: client fetch on mount, `cache: 'no-store'`,
  `buildBffAuthHeaders()`.
- **Auth/role check**: admin-scoped fail-closed (401/403 → unauthorized state)
  behind the proxy studio gate.

## Cross-references

- Studio overview: [`studio-overview.md`](../../studio-overview.md)
- Workspace source:
  `apps/oshun/web/src/components/studio/StudioYemayaRbacWorkspace.tsx`
- Route map source:
  `apps/oshun/web/src/components/studio/StudioYemayaRbacRouteMap.ts`
- Engine: `@yemaya/rbac`
- Embedded by: [`studio-yemaya-auth.md`](./studio-yemaya-auth.md),
  [`studio-yemaya-organizations.md`](./studio-yemaya-organizations.md)
- Feature spec: [`V1/features.md`](../../../../V1/features.md)

## Open questions / known gaps

- [ ] The Route Map advertises scenes / exports / revisions / parity / governance
      sub-routes that the live permission-check lane does not expose.