​

Role-Based Access Control

​

Role Hierarchy

​

Permission Categories

​

Memory Permissions

• memory:read — Read memories within scope
• memory:write — Create and update memories
• memory:delete — Delete memories

​

Entity Permissions

• entity:read — Read knowledge graph entities
• entity:write — Create and update entities
• entity:delete — Delete entities

​

System Permissions

• skills:manage — Create, update, delete skills
• skills:execute — Execute skills
• agents:manage — Create, update, delete agents
• apikeys:manage — Manage API keys
• compression:manage — Manage compression settings
• benchmark:run — Run benchmarks
• admin:all — Full administrative access

​

Scope System

​

Enforcement

// API route protection examples
s.router.Handle("/memories", requirePermission(roles.PermWriteMemory)(createMemoryHandler))
s.router.Handle("/skills", requirePermission(roles.PermManageSkills)(createSkillHandler))
s.router.Handle("/admin/users", requirePermission(roles.PermAdmin)(listUsersHandler))

​

Configuration

# Enable RBAC
RBAC_ENABLED=true

# Default role for new users
RBAC_DEFAULT_ROLE=user

# Super admin API key
RBAC_ADMIN_API_KEY=sk_admin_your-key

​

API Key Scoping

from hystersis import Hystersis

# Create a read-only API key
client = Hystersis(api_key="admin-key")
key = client.create_api_key(
    name="readonly-key",
    permissions=["memory:read", "search:read"],
    rate_limit={"requests_per_minute": 100}
)

​

See Also

• RBAC Feature for detailed enforcement
• Authentication API for API key management