---
title: "Authorization"
description: ""
---
NeMo Platform authorization controls what authenticated users can do. Every API request is evaluated against the user's token scopes and role bindings before it is allowed.

The authorization model has four building blocks:

1. **Workspaces** — the authorization boundary. All resources belong to a workspace.
2. **Roles** — permission bundles (Viewer, Editor, Admin) granted per workspace.
3. **Role bindings** — the link between a user, a role, and a workspace.
4. **Scopes** — token-level restrictions that limit what the token can do, independent of the user's role.

```text
Request → PDP → Scope check → Role binding check → Allow / Deny
```

For a request to succeed, both the scope check (does the token allow it?) and the role check (does the user have permission?) must pass.

For the full conceptual background, see [Authorization Concepts](/documentation/access-control/concepts). For the security architecture, see [Security Model](/documentation/access-control/security-model).

## Key Pages

<Cards>

<Card title="Roles & Permissions" href="/documentation/access-control/authorization/roles-and-permissions">

Complete permission matrix — what each role can do.

</Card>
<Card title="Managing Access" href="/documentation/access-control/authorization/managing-access">

Add users to workspaces, assign roles, manage members.

</Card>
<Card title="API Scopes" href="/documentation/access-control/authorization/api-scopes">

Token-level scope model and two-layer authorization.

</Card>
<Card title="Permissions Reference" href="/documentation/access-control/authorization/permissions-reference">

Complete list of all permissions with role assignments.

</Card>
<Card title="Policy Engine" href="/documentation/access-control/authorization/policy-engine">

OPA / WASM policy engine internals and configuration.

</Card>

</Cards>
