Define roles and the permission matrix

Enforcement needs a truth table - write it before code.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

Define the RBAC spec. List: the role set (e.g. admin, member, viewer) and a default role for new users; a permission matrix table of every sensitive action (manage users, edit content, delete records, view admin pages, change settings) versus each role with allow/deny; where the role is stored (user record, server-side) and how the backend reads it (from the session, never the request body).

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

A complete role list and action-by-role permission matrix.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Every sensitive action appears in the matrixDefault role for new users is setRole source of truth is the server-side user record

Do not continue if…

! Role checks only in the frontend
! Role read from localStorage where users can edit it
! Admin endpoints open to any authenticated user
! Role changes requiring logout/login to apply

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

The matrix is incomplete or the role comes from the client. Enumerate every mutating endpoint into the matrix and bind role reads to the authenticated session user.