# TraconPolicies

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.traconpolicies/
> Summary: TraconPolicies: Role-based authorization policy names that Tracon defines.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.AspNetCore.dll</code></div>

Role-based authorization policy names that Tracon defines.

```csharp
public static class TraconPolicies
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.traconpolicies/">TraconPolicies</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.memberwiseclone">object.MemberwiseClone()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

**Tracon stores no user and no role.** Roles come from the
consumer identity system; Tracon defines only the policy *name*, and
the consumer binds those names to its own claims:

```csharp
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy(TraconPolicies.Reader,   p => p.RequireRole("tracon-reader",
                                                                     "tracon-operator",
                                                                     "tracon-admin"));
    options.AddPolicy(TraconPolicies.Operator, p => p.RequireRole("tracon-operator",
                                                                     "tracon-admin"));
    options.AddPolicy(TraconPolicies.Admin,    p => p.RequireRole("tracon-admin"));
});
```

**When a policy is not registered, that endpoint falls back to its earlier
behavior** (only the existing three-layer protection: loopback, bearer token,
general authorization policy). Otherwise this role model would break the setup of
everyone who updates, with a `403`. A production setup can turn a missing policy
into a startup failure with [TraconEndpointOptions.RequireRolePolicies](/api/tracon.traconendpointoptions/#Tracon_TraconEndpointOptions_RequireRolePolicies).

## Fields

### <a id="Tracon_TraconPolicies_Admin"></a> Admin

Everything: writing an agent definition, adding an MCP server, deleting an
approval rule, tenant management.

```csharp
public const string Admin = "Tracon.Admin"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

### <a id="Tracon_TraconPolicies_Operator"></a> Operator

Reader plus starting a run, granting an approval, deleting a session.

```csharp
public const string Operator = "Tracon.Operator"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

### <a id="Tracon_TraconPolicies_PlatformAdmin"></a> PlatformAdmin

Acting on a tenant other than the caller's own: another tenant's model
provider bindings and egress policy, and the tenant records of the
installation.

```csharp
public const string PlatformAdmin = "Tracon.PlatformAdmin"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

#### Remarks

**Unlike the three role policies, a missing registration denies.**
An unregistered role policy falls back to the three-layer protection so
that an upgrade does not break a setup; a claims-authenticated caller of
tenant A reaching tenant B's secrets is not a fallback worth keeping.
Only a claims principal needs this policy: an API key proves platform
authority with the [ApiKeyScope.PlatformAdmin](/api/tracon.apikeyscope/) scope, and the
static [TraconEndpointOptions.AuthToken](/api/tracon.traconendpointoptions/#Tracon_TraconEndpointOptions_AuthToken) identifies the
installation itself.

The caller's own tenant never needs it: that stays with
[TraconPolicies.Admin](/api/tracon.traconpolicies/#Tracon_TraconPolicies_Admin).

### <a id="Tracon_TraconPolicies_Reader"></a> Reader

Read access: agents, runs, sessions, traces, statistics.

```csharp
public const string Reader = "Tracon.Reader"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)