Security

Note: This schema is under evaluation and may be replaced soon.

Overview

Security domains within the AV API will be built around the concept of personas. Each persona represents a single actor, whether they are human or or not, and is defined by the actions that persona will be allowed to perform within the API.

Roles

Average Josephine

The public user is able to see the AV API exists via the chosen publication method(s). They may subscribe to the API and request information about resources exposed through the API.

Clarence the Clerk

The mid-level access user is able to request information about resources exposed through the API. As a user with a primary role in upkeep in AV systems, the clerk is able to modify most resources. There may be some resources where a deletion is not allowed, but that is the exception, not the rule. Mid-level access allows creation of most resource objects.

Data Manager Mike

Administrative access is granted to data stewards and trusted systems. In addition to the mid-level access role, the administrator has rights to create, modify, or delete any resource.

Root

Root is...well...root. This user is able to create resource types. This is not an API-exposed user role, but is only exposed through access to the data layer.