epic-permissions

To implement RBAC in Epic Stack, you apply explicit permission strings like create:note:own or read:note:any within your routes, loaders, and actions to validate and enforce access control on the server before processing requests.

The best way to gate UI components in an Epic Stack app is to apply explicit RBAC permission checks on the client side. You validate user permissions using structured permission strings to conditionally render or hide interface elements securely.

Permission strings for role-based access control are structured as explicit action and scope combinations, such as create:note:own or read:note:any, standardizing security patterns by defining exact operations and ownership boundaries for user roles.

Yes, the RBAC model includes a scalable seed mechanism that establishes clear associations between users, roles, and permissions, allowing you to initialize and standardize security patterns across your entire project during setup.

Yes, Epic Stack RBAC supports enforcing access control based on ownership. You can require specific permissions using ownership scopes like create:note:own to ensure users can only manage resources they directly own within the route validation logic.