Discovered RBAC Authorization Matrix

Access boundary rules verified across REST API routes and application views.

OWNER

Full administrative tenant authority including deletion, member roles, and billing.

Allowed Routes:

All Routes (*)

Allowed Endpoints:

All Endpoints (*)

ADMIN

Project, suite, and member management with billing read-only access.

Allowed Routes:

/dashboard/projects/*/settings/team/settings/api-keys

Allowed Endpoints:

/api/v1/projects/*/api/v1/team/*/api/v1/runs/*

QA_ENGINEER

Test case generation, suite execution, finding triage, and auto-healing triggers.

Allowed Routes:

/dashboard/projects/*/findings/settings/api-keys

Allowed Endpoints:

/api/v1/projects/*/api/v1/runs/*/api/v1/findings/*

DEVELOPER

Feature development testing, suite creation, and test execution.

Allowed Routes:

/dashboard/projects/*/runs/*

Allowed Endpoints:

/api/v1/projects/api/v1/runs

VIEWER

Read-only visibility into test executions and findings.

Allowed Routes:

/dashboard/projects/runs/*/findings

Allowed Endpoints:

GET /api/v1/projectsGET /api/v1/runs/*GET /api/v1/findings