Roles, Capabilities, and Scope

GovFrame separates three concepts that are often confused:

Tenant role: what type of responsibility a person has within a company.
Capability: what action that role can perform.
Scope: which Domains or Subdomains they can exercise it over.

A role alone does not grant unlimited access. The backend checks the role, capability, tenant, membership status, and object scope.

Platform plane and tenant plane

platformRole and the tenant role are distinct layers:

The Superadministrator operates the global plane, can select an active company, and can administer permitted platform configurations.
The tenant role defines governance operations within the selected company.
Global selection does not allow crossing companies or bypassing module, membership, capability, or scope checks in tenant procedures.
The interface may display “Superadministrator · Administrator,” but the combined text does not turn both fields into a single persisted role.

Current tenant roles

Role	Technical key	Responsibility	Base capabilities	Typical scope
User	`user`	View, comment, and participate in authorized activities.	`stewardship.participate`	According to the views and requests the tenant permits for them.
Data Steward	`data_steward`	Maintain business definitions and objects, participate in stewardship, and handle tasks.	`stewardship.participate`, `business.manage`, `stewardship.manage`	Assigned Domains/Subdomains.
Data Owner	`data_owner`	Be responsible for governance within their scope and approve decisions.	Those of a Steward plus `domain.manage` and `stewardship.approve`.	Assigned Domains/Subdomains; may be global when appropriate.
Data Engineer	`data_engineer`	Administer connectors, repositories, metadata, snapshots, and schedules.	`stewardship.participate`, `technical.manage`	Repositories assigned through technical scopes.
Administrator	`admin`	Administer people, access, taxonomy, governance, and tenant configuration.	`business.manage`, `domain.manage`, `taxonomy.manage`, `stewardship.manage`, `stewardship.approve`, `stewardship.participate`, `access.manage`, `technical.manage`	Global within the active tenant.

Current capabilities

Capability	Mainly allows
`business.manage`	Create or maintain terms, rules, the dictionary, assets, and other business objects within scope.
`domain.manage`	Administer domain objects, products, contracts, policies, and operations that require scope responsibility.
`taxonomy.manage`	Create, edit, associate, and administer the taxonomy structure, subject to procedure safeguards.
`stewardship.manage`	Maintain classifications, certifications, comments, and stewardship tasks.
`stewardship.approve`	Approve decisions or stewardship and governance statuses that require it.
`stewardship.participate`	View and participate in permitted tasks or records.
`access.manage`	Manage access, users, memberships, requests, and provisioning according to the operation.
`technical.manage`	Manage connectors, repositories, scans, snapshots, metadata, and schedules within the technical scope.

The list above describes backend capabilities, not just interface buttons. Hiding a button never replaces server-side rejection.

Scope by Domain and Subdomain

Non-global users may have:

one or more Domain scopes;
one or more Subdomain scopes;
validity periods and status for each assignment;
independent technical scopes for the Data Engineer’s Data Repositories.

The system calculates scope from the session and the object. It does not accept tenantId, a Domain, Subdomain, or user sent by the browser as an authorization source.

A person may view more objects than they can edit. For example, an Owner or Steward may have visibility into tenant objects, but can create, edit, associate, or approve only within their authorized Domain/Subdomain and with the required capability.

Governance responsibilities

In addition to the session role, the catalog can record governance responsibilities:

Data Owners and Data Stewards are assigned to taxonomy nodes and can be linked to Entities.
A governance Role is a catalog object; it should not be confused with the technical role in tenant_memberships.
A Product or Contract can reference an Owner role.
A Workflow may require a base role or a governance role configured by the company.

What the company can customize

The company can customize responsibilities and operations without turning the security model into an arbitrary permissions system:

create and maintain governanceRoles objects;
define additional Workflow roles through workflowRoleDefinitions;
assign Owners/Stewards to taxonomy nodes;
assign Domains, Subdomains, and Repositories to people;
configure modules, locales, statuses, and Workflow parameters.

The five base roles and their backend capabilities are a current contract. The interface does not provide free editing of each capability per user. If fully configurable roles are enabled in the future, this must be documented as a contract change and tested in the backend.

Visibility and editing rules

The effective tenant is obtained from the session, hostname, and membership.
A deactivated membership or a suspended company must not operate normally.
A deactivated module hides the functionality, and its routers reject the operation.
Owners and Stewards may view according to the current policy, but their write actions are limited to their assigned scope.
The Data Engineer operates only on Repositories with an active technical scope.
The Superadministrator uses platform procedures for global administration; when acting on tenant objects, procedure safeguards remain in place.