> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-helix/_mcp/server.

# Authorization

NeMo Helix authorization controls what authenticated principals can do. Every
API request is evaluated against the principal's role bindings, and against
token scopes when the token carries NeMo Helix API scopes.

The authorization model has four building blocks:

1. **Workspaces** — the authorization boundary. All resources belong to a workspace.
2. **Roles** — permission bundles (Viewer, Editor, Admin) granted per workspace.
3. **Role bindings** — the link between a principal, a role, and a workspace.
4. **Scopes** — token-level restrictions that limit what the token can do, independent of the principal's role.

```text
Request → PDP → Scope check → Role binding check → Allow / Deny
```

For a request to succeed, the role check must pass. If the token contains
platform API scopes such as `intake:write` or `platform:read`, the scope check
must pass too.

For the full conceptual background, see [Authorization Concepts](/documentation/access-control/concepts). For the security architecture, see [Security Model](/documentation/access-control/security-model).

## Key Pages

#### [Roles & Permissions](/documentation/access-control/authorization/roles-and-permissions)

Complete permission matrix — what each role can do.

#### [Managing Access](/documentation/access-control/authorization/managing-access)

Add users to workspaces, assign roles, manage members.

#### [API Scopes](/documentation/access-control/authorization/api-scopes)

Token-level scope model and two-layer authorization.

#### [Permissions Reference](/documentation/access-control/authorization/permissions-reference)

Complete list of all permissions with role assignments.

#### [Policy Engine](/documentation/access-control/authorization/policy-engine)

OPA / WASM policy engine internals and configuration.

## Docs

- [API Scopes](https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/api-scopes.md): 
- [Managing Access](https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/managing-access.md): 
- [Permissions Reference](https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/permissions-reference.md): 
- [Plugin Authorization](https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/plugin-authorization.md): 
- [Policy Engine](https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/policy-engine.md): 
- [Roles and Permissions](https://docs.nvidia.com/nemo-helix/v0.9/documentation/access-control/authorization/roles-and-permissions.md):