Roles and permissions (RBAC)

FastStaq ships role-based access control so you can give the right people the right access without scattering permission checks across your code.

Roles

Out of the box FastStaq includes roles such as:

• OWNER: full control, the highest level.
• ADMIN: administrative access to the admin panel.
• SUPPORT_AGENT: access to the support console to handle tickets and chats.
• USER: a standard customer account.

A user has a primary role and can also carry role assignments, so the system behaves consistently across the legacy role field and the multi-role assignments.

How permissions are enforced

• Permissions are defined in a central registry rather than hard-coded per route.
• Server middleware gates each protected endpoint by the required permission, so the API is the source of truth (the UI hiding a button is never the only protection).
• Admin-tier access additionally respects the 2FA enforcement policy.

Granting roles

• Promote users from the admin panel.
• For bootstrapping or automation, use the CLI:

pnpm --filter @faststaq/server create-admin you@example.com --role OWNER

Promotions are written to the audit log.

Adding or changing roles

To introduce a new role or permission:

1. Add the role/permission to the registry.
2. Apply the required permission to the relevant routes and UI.
3. Assign the role to users.

Because checks reference the registry, you change access in one place rather than hunting through controllers.

Related articles

• Admin panel and settings
• Authentication module

Still need help?

Open a support ticket for help designing your role model.