---
title: 'Roles, Capabilities, and Scope'
slug: roles-capacidades-y-alcance
description: >-
  Functional reference for tenant roles, capabilities, scopes, and
  responsibilities in GovFrame.
audiencia: Administrator | Data Owner | Data Steward | Data Engineer | Superadministrator
roles: >-
  Administrator or Superadministrator to configure access; view access for all
  authenticated roles
modulo: Access and governance
estado: Validated current behavior
revision: '2026-10-19'
section: referencia
order: 10
sources:
  - 'Roles,capacidadesyalcance.md'
locale: en
---
# Roles, Capabilities, and Scope

GovFrame separates three concepts that are often confused:

1. **Tenant role:** what type of responsibility a person has within a company.
2. **Capability:** what action that role can perform.
3. **Scope:** which Domains or Subdomains they can exercise it over.

A role alone does not grant unlimited access. The backend checks the role, capability, tenant, membership status, and object scope.

## Platform plane and tenant plane

`platformRole` and the tenant role are distinct layers:

- The **Superadministrator** operates the global plane, can select an active company, and can administer permitted platform configurations.
- The **tenant role** defines governance operations within the selected company.
- Global selection does not allow crossing companies or bypassing module, membership, capability, or scope checks in tenant procedures.
- The interface may display “Superadministrator · Administrator,” but the combined text does not turn both fields into a single persisted role.

## Current tenant roles

| Role | Technical key | Responsibility | Base capabilities | Typical scope |
|---|---|---|---|---|
| **User** | `user` | View, comment, and participate in authorized activities. | `stewardship.participate` | According to the views and requests the tenant permits for them. |
| **Data Steward** | `data_steward` | Maintain business definitions and objects, participate in stewardship, and handle tasks. | `stewardship.participate`, `business.manage`, `stewardship.manage` | Assigned Domains/Subdomains. |
| **Data Owner** | `data_owner` | Be responsible for governance within their scope and approve decisions. | Those of a Steward plus `domain.manage` and `stewardship.approve`. | Assigned Domains/Subdomains; may be global when appropriate. |
| **Data Engineer** | `data_engineer` | Administer connectors, repositories, metadata, snapshots, and schedules. | `stewardship.participate`, `technical.manage` | Repositories assigned through technical scopes. |
| **Administrator** | `admin` | Administer people, access, taxonomy, governance, and tenant configuration. | `business.manage`, `domain.manage`, `taxonomy.manage`, `stewardship.manage`, `stewardship.approve`, `stewardship.participate`, `access.manage`, `technical.manage` | Global within the active tenant. |

## Current capabilities

| Capability | Mainly allows |
|---|---|
| `business.manage` | Create or maintain terms, rules, the dictionary, assets, and other business objects within scope. |
| `domain.manage` | Administer domain objects, products, contracts, policies, and operations that require scope responsibility. |
| `taxonomy.manage` | Create, edit, associate, and administer the taxonomy structure, subject to procedure safeguards. |
| `stewardship.manage` | Maintain classifications, certifications, comments, and stewardship tasks. |
| `stewardship.approve` | Approve decisions or stewardship and governance statuses that require it. |
| `stewardship.participate` | View and participate in permitted tasks or records. |
| `access.manage` | Manage access, users, memberships, requests, and provisioning according to the operation. |
| `technical.manage` | Manage connectors, repositories, scans, snapshots, metadata, and schedules within the technical scope. |

The list above describes backend capabilities, not just interface buttons. Hiding a button never replaces server-side rejection.

## Scope by Domain and Subdomain

Non-global users may have:

- one or more **Domain scopes**;
- one or more **Subdomain scopes**;
- validity periods and status for each assignment;
- independent technical scopes for the Data Engineer’s Data Repositories.

The system calculates scope from the session and the object. It does not accept `tenantId`, a Domain, Subdomain, or user sent by the browser as an authorization source.

A person may view more objects than they can edit. For example, an Owner or Steward may have visibility into tenant objects, but can create, edit, associate, or approve only within their authorized Domain/Subdomain and with the required capability.

## Governance responsibilities

In addition to the session role, the catalog can record governance responsibilities:

- **Data Owners** and **Data Stewards** are assigned to taxonomy nodes and can be linked to Entities.
- A governance Role is a catalog object; it should not be confused with the technical role in `tenant_memberships`.
- A Product or Contract can reference an Owner role.
- A Workflow may require a base role or a governance role configured by the company.

## What the company can customize

The company can customize responsibilities and operations without turning the security model into an arbitrary permissions system:

- create and maintain `governanceRoles` objects;
- define additional Workflow roles through `workflowRoleDefinitions`;
- assign Owners/Stewards to taxonomy nodes;
- assign Domains, Subdomains, and Repositories to people;
- configure modules, locales, statuses, and Workflow parameters.

The five base roles and their backend capabilities are a current contract. The interface does not provide free editing of each capability per user. If fully configurable roles are enabled in the future, this must be documented as a contract change and tested in the backend.

## Visibility and editing rules

1. The effective tenant is obtained from the session, hostname, and membership.
2. A deactivated membership or a suspended company must not operate normally.
3. A deactivated module hides the functionality, and its routers reject the operation.
4. Owners and Stewards may view according to the current policy, but their write actions are limited to their assigned scope.
5. The Data Engineer operates only on Repositories with an active technical scope.
6. The Superadministrator uses platform procedures for global administration; when acting on tenant objects, procedure safeguards remain in place.

## Related content

- [Object model and relationships](/en/explicaciones/modelo-de-objetos-y-relaciones/)
- [Modules and dependencies](/en/referencia/modulos-y-dependencias/)
- [Configure people, roles, and scope](/en/administrar-empresa/personas-y-alcance/)
- [Security and privacy](/en/seguridad/seguridad-y-sesiones/)