> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bijection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authority

> Who can do what, and where that decision is made.

Identity belongs to the identity provider. Capability vocabulary belongs to
Bijection. The two meet at exactly one mapping.

## Four exclusive workspace roles

A membership holds exactly one of:

| Role       | Can                                                       |
| ---------- | --------------------------------------------------------- |
| `member`   | Read                                                      |
| `operator` | Read, and mutate the live world through governed surfaces |
| `admin`    | Read, and administer membership and settings              |
| `owner`    | The written-down combination of admin and operator        |

**Admin does not imply operator.** Single-role assignment is the correct provider
configuration; a membership carrying two workspace roles is drift.

## How a ceiling is derived

The provider publishes **no** Bijection permissions at all. A principal's ceiling
comes from the role slug alone, resolved through the committed binding in
`grants.json`, and the security layer expands that profile into the internal
capability vocabulary — `atelier.members.manage`, `atelier.settings.read`,
`atelier.actions.execute`, and so on — which the provider never sees.

<Warning>
  Any `bijection.*` permission found on a provider role or in the provider catalog is
  drift to delete.
</Warning>

Runtime checks internal capabilities, never role slugs.

`grants.json` carries only the organization, the role-to-profile bindings, the
trusted attribute bindings, and the expected agent registrations. No capability
arrays. No membership map.

## Break glass

`atelier.ledger.erase` is the one break-glass capability. It is not a provider
permission and belongs to no standing role — the recorded activation *is* the
grant.

## Model roles are not workspace roles

A model's own role vocabulary is derived from a trusted attribute, never from a
workspace role. A clinical model's `oversight_lead` and the workspace's
`operator` are different alphabets that happen to be spoken by the same person.

## Agents

An agent credential narrows its delegating human's ceiling through a token scope
Bijection owns outright. Agents plan and execute through the public surfaces under
their own machine authority.

```bash theme={null}
atelier whoami
mothership grants-check --json
```