{"slug":"security-and-governance/permissions","title":"Permissions and Access in SpineWorkspace","section":"security-and-governance","sectionLabel":"Security & Governance","status":"unclassified","type":"document","path":"security-and-governance/permissions.mdx","bytes":890,"description":"Permissions in SpineWorkspace combine roles, scopes, and capability-level authorization so people, Twin, and agents only reach what policy allows.","updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\nPermissions in SpineWorkspace combine roles, scopes, and capability-level authorization. A user's role sets what they can see. A connection's scope sets what a source system exposes. A capability's authorization gates every action before it runs.\n\n## The Model\n\n- **Roles** — who can view or work each domain and view.\n- **Scopes** — which parts of a source system a connection can read or write.\n- **Capability authorization** — which actor can invoke which capability under which policy.\n\n## Related\n\n- [Governance](/security-and-governance/governance)\n- [Security](/security-and-governance/security)\n- [One Auth](/platform/one-auth)"}