Role and entitlement-triple matrix

InBlack authorization uses product:module:action keys. The checked-in RBAC catalog defines six products: Accounting, Commerce, Studio, Customer 360 (cx), Reporting, and Data X (datax). Portal membership and billing checks are separate from this module catalog.

Built-in roles

Role	Canonical grants	Explicit boundary
`owner`	Every catalog product and action	Built-in owner role
`admin`	Every catalog product and action	`commerce:billing` denied
`developer`	Studio plus read access to Commerce catalog, channels, and settings	`studio:api_keys` denied
`marketing`	Curated Commerce, Studio, CX, and Reporting access	No Accounting or Data X grant
`accounting`	Full Accounting and Reporting; Commerce orders/customers read	No general Commerce write
`fulfillment`	Commerce dashboard, orders, inventory, suppliers, purchase orders, assemblies, returns	No catalog or billing grant
`view-only`	`view` actions across Accounting, Commerce, Studio, CX, and Reporting	`studio:api_keys` denied; no Data X grant

Product-wide grants expand only to actions declared by that product’s module catalog. A wildcard does not create unsupported actions.

Membership bridge

Standard membership roles map to immutable built-in templates:

Membership role	Entitlement role
`owner`	`owner`
`admin`	`admin`
`accountant`	`accounting`
`member`	`view-only`
`viewer`	`view-only`

Unknown membership roles fail closed in authorization checks. The built-in developer, marketing, and fulfillment templates are not values in the standard Portal invite role enum.

Catalog modules

Product	Modules
Accounting	dashboard, chart of accounts, journal entries, reconciliation, bank feeds, AR, AP, vendors, reports, provider connections, settings
Commerce	dashboard, catalog, channels, inventory, orders, customers, transactional emails, SEO, discounts, suppliers, purchase orders, assemblies, returns, imports, settings, billing
Studio	dashboard, AI/visual/code builders, sites, email templates, themes, analytics, site presence, redirects, API keys, settings
CX	dashboard, contacts, segments, journeys, settings
Reporting	dashboard, reports, data explorer, settings
Data X	user-defined tables and records through the `datax` module

Use the live role editor for custom role IDs. Custom roles are tenant rows and can select supported entitlements, but they cannot become the owner role.