Sep 10, 2024 · Jul 31, 2024 · Jul 31, 2024 · Jul 31, 2024 · Jul 31, 2024 · Aug 1, 2024
diff --git a/coderd/rbac/README.md b/coderd/rbac/README.md
 # Authz

 Package `authz` implementsAuthoriZation for Coder.
 Package `rbac` implementsRole-Based Access Control for Coder.

 ## Overview

 Authorization defines what **permission** a **subject** has to perform **actions** to **objects**:

 - **Permission** is binary: _yes_ (allowed) or _no_ (denied).
 - **Subject** in this case is anything that implements interface `authz.Subject`.
 - **Action** here is an enumerated list of actions, but we stick to`Create`, `Read`, `Update`,and`Delete` here.
 - **Object** here is anything that implements `authz.Object`.
 - **Subject** in this case is anything that implements interface `rbac.Subject`.
 - **Action** here is an enumerated list of actions. Actions can differ for each object type. They typically read like,`Create`, `Read`, `Update`, `Delete`, etc.
 - **Object** here is anything that implements `rbac.Object`.

 ## Permission Structure

 | read   | Y        | \_       | Y      |
 | read   | Y        | N        | N      |
 | read   | \_       | \_       | \_     |
 | read   | \_       | N        |Y      |
 | read   | \_       | N        |N      |

 ## Permission Representation

 - `object` is any valid resource type.
 - `id` is any valid UUID v4.
 - `id` is included in the permission syntax, however only scopes may use `id` to specify a specific object.
 - `action` is `create`, `read`, `modify`,or`delete`.
 - `action` istypically`create`, `read`, `modify`, `delete`, but you can define other verbs as needed.

 ## Example Permissions

 - `+site.*.*.read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
 - `+site.app.*.read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
 - `-user.workspace.*.create`: user is not allowed to create workspaces.

 ## Roles

 **Evaluation**

 ```bash
 opa eval --format=pretty "data.authz.allow" -d policy.rego -i input.json
 ```

 **Partial Evaluation**
Original file line number	Diff line number	Diff line change
		@@ -1,15 +1,15 @@
		# Authz

		Package `authz` implementsAuthoriZation for Coder.
		Package `rbac` implementsRole-Based Access Control for Coder.

		## Overview

		Authorization defines what permission a subject has to perform actions to objects:

		- Permission is binary: _yes_ (allowed) or _no_ (denied).
		- Subject in this case is anything that implements interface `authz.Subject`.
		- Action here is an enumerated list of actions, but we stick to`Create`, `Read`, `Update`,and`Delete` here.
		- Object here is anything that implements `authz.Object`.
		- Subject in this case is anything that implements interface `rbac.Subject`.
		- Action here is an enumerated list of actions. Actions can differ for each object type. They typically read like,`Create`, `Read`, `Update`, `Delete`, etc.
		- Object here is anything that implements `rbac.Object`.

		## Permission Structure

Expand DownExpand Up		@@ -38,7 +38,7 @@ This can be represented by the following truth table, where Y represents _positi
		\| read \| Y \| \_ \| Y \|
		\| read \| Y \| N \| N \|
		\| read \| \_ \| \_ \| \_ \|
		\| read \| \_ \| N \|Y \|
		\| read \| \_ \| N \|N \|

		## Permission Representation

Expand All		@@ -49,11 +49,11 @@ This can be represented by the following truth table, where Y represents _positi
		- `object` is any valid resource type.
		- `id` is any valid UUID v4.
		- `id` is included in the permission syntax, however only scopes may use `id` to specify a specific object.
		- `action` is `create`, `read`, `modify`,or`delete`.
		- `action` istypically`create`, `read`, `modify`, `delete`, but you can define other verbs as needed.

		## Example Permissions

		- `+site...read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
		- `+site.app.*.read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
		- `-user.workspace.*.create`: user is not allowed to create workspaces.

		## Roles
Expand DownExpand Up		@@ -106,7 +106,9 @@ You can test outside of golang by using the `opa` cli.

		Evaluation

		```bash
		opa eval --format=pretty "data.authz.allow" -d policy.rego -i input.json
		```

		Partial Evaluation

Expand Down