TraconPolicies

Namespace Tracon · Assembly Tracon.AspNetCore.dll

Role-based authorization policy names that Tracon defines.

public static class TraconPolicies

Inheritance

object ← TraconPolicies

Inherited Members

object.GetType(), object.MemberwiseClone(), object.ToString(), object.Equals(object?), object.Equals(object?, object?), object.ReferenceEquals(object?, object?), object.GetHashCode()

Remarks

Tracon stores no user and no role. Roles come from the consumer identity system; Tracon defines only the policy name, and the consumer binds those names to its own claims:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy(TraconPolicies.Reader,   p => p.RequireRole("tracon-reader",
                                                                     "tracon-operator",
                                                                     "tracon-admin"));
    options.AddPolicy(TraconPolicies.Operator, p => p.RequireRole("tracon-operator",
                                                                     "tracon-admin"));
    options.AddPolicy(TraconPolicies.Admin,    p => p.RequireRole("tracon-admin"));
});

When a policy is not registered, that endpoint falls back to its earlier behavior (only the existing three-layer protection: loopback, bearer token, general authorization policy). Otherwise this role model would break the setup of everyone who updates, with a 403. A production setup can turn a missing policy into a startup failure with TraconEndpointOptions.RequireRolePolicies.

Fields

Admin

Everything: writing an agent definition, adding an MCP server, deleting an approval rule, tenant management.

public const string Admin = "Tracon.Admin"

Field Value

string

Operator

Reader plus starting a run, granting an approval, deleting a session.

public const string Operator = "Tracon.Operator"

Field Value

string

Reader

Read access: agents, runs, sessions, traces, statistics.

public const string Reader = "Tracon.Reader"

Field Value

string