public.rbac_role_definitions

Synced from docs/generated/erd/ — do not hand-edit.
Regenerate with bun run docs:erd (needs staging reader), then this script runs automatically.
Labels: docs/db/erd-table-labels.yml · Runbook: docs/runbooks/erd-schema-docs.md

Description

Catalog of PRIVILEGE-bearing RBAC roles (role_key, default permission + module keys) — Not: role_definitions — that is the member service-role catalog and grants nothing — See: docs/PLATFORM.md

Columns

Name	Type	Default	Nullable	Children	Parents	Comment
created_at	timestamp with time zone	now()	false
dashboard_config	jsonb		true
default_module_keys	text[]	‘{}’::text[]	false
default_permissions	text[]	‘{}’::text[]	false
description	text		true
id	uuid	gen_random_uuid()	false	public.rbac_org_user_roles
is_system	boolean	false	false
label	text		false
org_id	text		true		organizations
role_key	text		false
sort_order	integer		true
updated_at	timestamp with time zone	now()	false

Viewpoints

Name	Definition
Identity, Tenancy & RBAC	Org tenancy, contacts/auth linking, seats (organization_users), and M-7 RBAC. Catalog §1. Seat holds presence only — privilege is rbac_org_user_roles, not organization_users.role_type (dropped). First review: contacts ↔ contact_auth ↔ organization_users ↔ rbac_*.

Constraints

Name	Type	Definition
rbac_role_definitions_org_id_fkey	FOREIGN KEY	FOREIGN KEY (org_id) REFERENCES organizations(id)
rbac_role_definitions_org_key_unique	UNIQUE	UNIQUE (org_id, role_key)
rbac_role_definitions_pkey	PRIMARY KEY	PRIMARY KEY (id)
rbac_role_definitions_system_key_unique	x	EXCLUDE USING btree (role_key WITH =) WHERE ((org_id IS NULL))

Indexes

Name	Definition
rbac_role_definitions_org_key_unique	CREATE UNIQUE INDEX rbac_role_definitions_org_key_unique ON public.rbac_role_definitions USING btree (org_id, role_key)
rbac_role_definitions_pkey	CREATE UNIQUE INDEX rbac_role_definitions_pkey ON public.rbac_role_definitions USING btree (id)
rbac_role_definitions_system_key_unique	CREATE INDEX rbac_role_definitions_system_key_unique ON public.rbac_role_definitions USING btree (role_key) WHERE (org_id IS NULL)

Triggers

Name	Definition
trg_rbac_validate_perm_keys_role	CREATE TRIGGER trg_rbac_validate_perm_keys_role BEFORE INSERT OR UPDATE ON public.rbac_role_definitions FOR EACH ROW EXECUTE FUNCTION rbac_validate_permission_keys()

Relations

erDiagram

"public.rbac_org_user_roles" }o--|| "public.rbac_role_definitions" : "FOREIGN KEY (role_id) REFERENCES rbac_role_definitions(id)"
"public.rbac_role_definitions" }o--o| "public.organizations" : "FOREIGN KEY (org_id) REFERENCES organizations(id)"

"public.rbac_role_definitions" {
  uuid id ""
  text org_id FK ""
}
"public.rbac_org_user_roles" {
  uuid assigned_by FK ""
  uuid contact_id FK ""
  text org_id FK ""
  uuid role_id FK ""
}
"public.organizations" {
  text association_id FK ""
  uuid default_approval_reviewer_contact_id FK "Org-level fallback reviewer for two-step send (#5698). Routing chain: the sender's own reviewer, then this, then all org admins. NULL means fall through to the admins, which is the pre-#5698 behaviour."
  text id ""
  text parent_org_id FK "#671 self-referencing hierarchy pointer. NULL = root org. Direct writes are blocked by trg_block_direct_parent_org_id_writes for every role except service_role/postgres/supabase_admin — the only write path for authenticated/interactive callers is public.reparent_organization(). Cycle-prevented by trg_prevent_org_hierarchy_cycle. #quot;Is association#quot; is derived (EXISTS a child), never stored."
}

---

Generated by tbls