---
name: bijection-permissions
description: "Evaluate and integrate the Permissions component with Bijection."
---

# Permissions

Role-based access control as a Bijection component — typed, sandboxed, runtime-editable roles and grants keyed by opaque refs

- Package: @bijectionhq/permissions
- Category: Authentication
- Status: Reference
- License: MIT
- Bijection source (repository access required): https://github.com/bijectionhq/permissions/tree/2f4fa8f5f4946a6158715221fcb4b661af28644c
- Upstream: https://github.com/vllnt/convex-permissions/tree/a2db4faabba934ee26eea53f48f0784b96cb95f3
- Documentation: https://docs.bijection.com/components/using
- Directory: https://bijection.com/components/permissions

## Get the source

Bijection repository access is required. Request access at https://bijection.com/contact.

```sh
git clone https://github.com/bijectionhq/permissions.git
cd permissions
git checkout 2f4fa8f5f4946a6158715221fcb4b661af28644c
```

## Before using this component

Read the package README at the recorded revision for setup, dependencies, and API examples. Upstream documentation describes the original package and may differ from the Bijection adaptation. This is a source candidate for evaluation. Catalog inclusion does not establish npm availability or runtime qualification. Check compatibility with your SDK and deployment before adoption. External providers run their own compute.

## Integration workflow

1. Read the source README and package manifest at the recorded revision.
2. Confirm the required SDK, dependency availability, and runtime compatibility.
3. Follow the component's documented setup and configuration. Never invent an npm install command from a catalog package name.
4. Keep credentials in the project's existing secret store.
5. Follow the project's execution rules for verification and report what was actually checked.

## Original upstream skill

The following guidance describes @vllnt/convex-permissions. Its installation commands and APIs refer to the upstream package. Evaluate compatibility with the Bijection source separately.


> Agents: read this skill fully before writing code that uses Permissions (RBAC). Follow the installation and configuration steps exactly.

# Permissions (RBAC)

## Instructions

@vllnt/convex-permissions stores role-based access control rules in isolated Convex tables. Define your own role and action vocabulary, assign roles to subject references, and evaluate access in the backend.

Define roles and grants, assign or revoke roles, and use check or require before a protected operation. Stored roles can change through mutations without a code deployment. Optional scope references partition assignments; unmatched actions are denied.

The host authenticates the caller, derives trusted subject and scope references, and protects role-management functions. Global assignments can apply across scopes, so grant them deliberately. The component is authorization storage and evaluation, not a login provider or an automatic guard on every endpoint.

Maintained by [bntvllnt](https://bntvllnt.com) at [VLLNT](https://vllnt.com). Find the author on [GitHub](https://github.com/bntvllnt) and [X](https://x.com/bntvllnt).

### Installation

```bash
npm install @vllnt/convex-permissions
```

Current npm version: `@vllnt/convex-permissions@0.1.0`

## Use cases

- SaaS workspaces: distinguish owners, administrators, and members by workspace.
- Education tools: give instructors and learners different actions.
- Communities and games: authorize moderation or team-management operations.
- Internal tools and agents: limit service identities to explicitly granted actions.

## How it works

Define roles and grants, assign or revoke roles, and use check or require before a protected operation. Stored roles can change through mutations without a code deployment. Optional scope references partition assignments; unmatched actions are denied.

The host authenticates the caller, derives trusted subject and scope references, and protects role-management functions. Global assignments can apply across scopes, so grant them deliberately. The component is authorization storage and evaluation, not a login provider or an automatic guard on every endpoint.

## When NOT to use

- When a simpler built-in solution exists for your specific use case
- If you are not using Convex as your backend
- When the functionality provided by Permissions (RBAC) is not needed

## Resources

- [npm package](https://www.npmjs.com/package/%40vllnt%2Fconvex-permissions)
- [GitHub repository](https://github.com/vllnt/convex-permissions)
- [Live demo](https://vllnt.com/)
- [Convex Components Directory](https://www.convex.dev/components/vllnt/convex-permissions)
- [Convex documentation](https://docs.convex.dev)