---
title: "Roles and permissions · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/roles-and-permissions
updated: 2026-10-20
licence: "All rights reserved"
---

# Roles and permissions

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Name permissions in code, map roles to them in one place, and test every role against every action. Then access stays right as the product grows.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/roles-and-permissions`.

## Required

- [Check permissions instead of role names](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permissions-not-roles): Make code ask whether a user has a named permission, such as `invoice.refund`. Map roles to permissions in one place, and never compare role names in feature code.
- [Test every role against every action](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permission-matrix-test): Keep a table of every role and every action with the expected answer, and run it as a test against the server on every change.
- [Give roles inside an organisation](https://agentwranglers.se/playbook/accounts/roles-and-permissions/org-scoped-roles): Store customer roles on the membership between a user and an organisation. Keep staff roles in a separate store that customer code cannot write.
- [Make role changes count on the next request](https://agentwranglers.se/playbook/accounts/roles-and-permissions/role-changes-immediate): Apply a removed role or permission within 60 seconds of the change. Never keep roles only inside a long-lived token or cache.
- [Limit tokens and agents to what their owner may do](https://agentwranglers.se/playbook/accounts/roles-and-permissions/delegated-permissions): Give an API key, connected app or AI agent at most its creator's permissions. Check the creator's current role on every call.

## Recommended

- [Start with roles and add record rules only when needed](https://agentwranglers.se/playbook/accounts/roles-and-permissions/rbac-then-abac): Start with a few roles per organisation. Add conditions on the record only for rules that need them, such as "only the author may edit a draft".
- [Let owners see who can do what](https://agentwranglers.se/playbook/accounts/roles-and-permissions/access-review): Give organisation owners one page that lists every member, role, sign-in method and last activity, with pending invitations, API keys and an export.

- Previous: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Next: [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams)
- [All chapters](https://agentwranglers.se/playbook/accounts)