{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/sidebars.yaml","oas-api-reference/management.yml":"oas-api-reference/management.yml"},"props":{"metadata":{"markdoc":{"tagList":["cards","card","admonition","tabs","tab","openapi-code-sample"]},"type":"markdown"},"seo":{"title":"Security Model Overview","siteUrl":"https://docs.synqly.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-model-overview","__idx":0},"children":["Security Model Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Security Model defines how identities authenticate to Synqly and how access to resources is authorized. It applies consistently across the Management API, Connector APIs and MCP servers."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The model combines permission sets, resource restrictions, roles, and scoped tokens to enforce least-privilege access while supporting auditing, delegation, and enterprise governance requirements."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you haven't read ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/concepts"},"children":["Understanding the Synqly Model"]}," yet, start there — it covers organizations, accounts, and members, which the Security Model acts on."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-authorization-is-determined","__idx":1},"children":["How authorization is determined"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section explains the RBAC model that the token types are built on. It provides the context needed when designing roles, troubleshooting unexpected access denials, or understanding why a token has a particular level of access."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Synqly's authorization model is built on three building blocks:"]},{"$$mdtype":"Tag","name":"Cards","attributes":{"columns":3,"cardMinWidth":240},"children":[{"$$mdtype":"Tag","name":"Card","attributes":{"title":"Permission sets","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled","to":"#permission-sets"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["What can you do?"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A named bundle of API actions. Fixed catalogue — you pick, not compose."]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"Resources","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled","to":"#resources"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["On which objects?"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Restrict by account ID, label, environment, or integration category."]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"Roles","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled","to":"#roles"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reusable pairing"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Named combination of permission set + resource restrictions. Bind to members."]}]}]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart LR\n ps(\"Permission Set\\n(the verbs)\")\n res(\"Resources\\n(the nouns)\")\n role(\"Role\\n(named combination)\")\n member(\"Member\\n(person or service)\")\n\n ps --> role\n res --> role\n role --> member\n","diagramHtml":"

Permission Set
(the verbs)

Resources
(the nouns)

Role
(named combination)

Member
(person or service)

","diagramHtmlDark":"

Permission Set
(the verbs)

Resources
(the nouns)

Role
(named combination)

Member
(person or service)

"},"children":["flowchart LR\n ps(\"Permission Set\\n(the verbs)\")\n res(\"Resources\\n(the nouns)\")\n role(\"Role\\n(named combination)\")\n member(\"Member\\n(person or service)\")\n\n ps --> role\n res --> role\n role --> member\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"permission-sets","__idx":2},"children":["Permission sets"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A permission set is a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["named, predefined bundle of API actions"]},". You pick from a fixed catalogue — you don't assemble one from scratch."]},{"$$mdtype":"Tag","name":"Cards","attributes":{"columns":2,"cardMinWidth":240},"children":[{"$$mdtype":"Tag","name":"Card","attributes":{"title":"administrator","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Full administrative access"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"viewer","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Read-only access across all resources"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"account-manager","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create and manage accounts, integrations, credentials"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"member","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Minimum access — log in, view own profile, basic status"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"connect-ui","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Power a Connect UI widget — create/delete integrations and credentials only"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"token-issuer","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Issue integration tokens, nothing else"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"mcp-integrations-use-only","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Read accounts/integrations + call Connector APIs"]}]},{"$$mdtype":"Tag","name":"Card","attributes":{"title":"mcp-management","imagePosition":"start","iconPosition":"auto","layout":"vertical","align":"start","variant":"filled"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create/update integrations, no Connector API access"]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"What exactly does a permission set allow?"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Don't guess — query the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.synqly.com/api-reference/management/permissionset"},"children":["Permission Sets API"]},". It returns the precise list of API actions each set grants."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"resources","__idx":3},"children":["Resources"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A permission set says ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["what you can do"]}," — but to ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["what"]},"? Without a resource restriction, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["administrator"]}," means administrator over ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["everything"]}," in your organization. Resources let you apply restrictions across three dimensions:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Organizations"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.organizations"]},") — restrict by organization ID or label"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Accounts"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.accounts"]},") — restrict by account ID, label, or environment"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resources.integrations"]},") — restrict by connector category"]}]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"div","attributes":{"label":"Restrict by account ID","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"resources:\n accounts:\n ids: [\"account-123\", \"account-456\"]\n","lang":"yaml"},"children":[]}]},{"$$mdtype":"Tag","name":"div","attributes":{"label":"Restrict by label + environment","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"resources:\n accounts:\n labels: [\"customer-success-team\"]\n environments: [\"prod\"]\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When both ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["labels"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["environments"]}," are specified, both must match — it's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AND"]}," logic, not OR. Valid environment values are ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["\"test\""]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["\"prod\""]},"."]}]},{"$$mdtype":"Tag","name":"div","attributes":{"label":"Restrict by integration category","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"resources:\n integrations:\n categories: [\"siem\", \"ticketing\"]\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Valid category values: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["appsec"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["assets"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["chat"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cloudsecurity"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["custom"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["edr"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["emailsecurity"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["endpointmanagement"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["identity"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["incidentresponse"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["operations"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["siem"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ticketing"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["vulnerabilities"]}]}]},{"$$mdtype":"Tag","name":"div","attributes":{"label":"Restrict by organization","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"resources:\n organizations:\n ids: [\"org-123\"]\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]}," to grant access to all organizations. You can also restrict by label using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["labels: [\"enterprise-tier\"]"]},"."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"roles","__idx":4},"children":["Roles"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A role is a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["permission set + resource restriction, given a name"]}," so you can reuse it across tokens and members."]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-api-reference/management.yml","operationId":"roles_create","language":"curl","parameters":{},"requestBody":{"name":"production-account-manager","resources":{"accounts":{"environments":["prod"],"labels":["customer-success-team"]}},"permission_set":"account-manager"},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.synqly.com/api-reference/management/roles"},"children":["Roles API reference"]}," for full create/list operations."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"members","__idx":5},"children":["Members"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A role does nothing until it's bound to a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["member"]}," — a human user or a service account. A member's effective access is the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["union"]}," of all their role bindings."]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-api-reference/management.yml","operationId":"members_create","language":"curl","parameters":{},"requestBody":{"name":"user@example.com","secret":"password123","role_binding":["production-account-manager"]},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Multiple role bindings are OR'd, not AND'd"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If any one of a member's roles permits an action, that action is permitted. Roles only ever ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["add"]}," capability — they cannot be used to carve exceptions from each other."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.synqly.com/api-reference/management/members"},"children":["Members API reference"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"why-synqly-uses-role-based-access-control","__idx":6},"children":["Why Synqly uses role-based access control"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Synqly uses role-based access control (RBAC) to support least-privilege access, resource isolation, and auditability. Instead of granting broad access through shared credentials, RBAC allows permissions to be assigned according to a caller's responsibilities and constrained to specific resources."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Shared credentials"},"children":["Shared credentials"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Role-based access control"},"children":["Role-based access control"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One credential is used by multiple callers"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Each caller receives only the permissions required for its role"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A credential compromise can expose all accessible resources"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access is limited to the permissions and resource restriction assigned to that role"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Actions cannot be reliably attributed to an individual caller"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Actions are attributed to a specific member, service account, or token"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access boundaries depend on how callers use the credential"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access boundaries are enforced by the platform"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A resource restriction is not a convention or expectation about how a caller should behave. It is a platform-enforced boundary that is evaluated on every request."]}]},"headings":[{"value":"Security Model Overview","id":"security-model-overview","depth":1},{"value":"How authorization is determined","id":"how-authorization-is-determined","depth":2},{"value":"Permission sets","id":"permission-sets","depth":3},{"value":"Resources","id":"resources","depth":3},{"value":"Roles","id":"roles","depth":3},{"value":"Members","id":"members","depth":3},{"value":"Why Synqly uses role-based access control","id":"why-synqly-uses-role-based-access-control","depth":2}],"frontmatter":{"slug":"guides/security-model","seo":{"title":"Security Model Overview"}},"lastModified":"2026-07-02T06:20:08.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/security-model","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}