create-rbac

Create roles first, then policies, link them via access entries, and finally create permission rules defining collection, action, fields, and item filters. Each step uses the corresponding DaaS MCP tool: roles, policies, access, and permissions.

Add an item-level filter using the $CURRENT_USER dynamic variable, such as { "user_created": { "_eq": "$CURRENT_USER" } }, on the permission's permissions field. Combine with presets to auto-set user_created on create actions.

A policy is a container linked to roles or users through access entries, while a permission is a single rule inside a policy defining collection, action, allowed fields, and item-level filters. Policies group multiple permissions together.

The app is likely missing the app/api/permissions/me/route.ts proxy route. Without it, Buildpad components fall back to empty permissions and grant full UI access, though DaaS still enforces permissions server-side.

Yes, use scope_config with allowed_scopes patterns on the role, then assign it via the scope tool's assign_user_role action with a resource_uri. The role only applies within that scope node and its descendants.