diff options
Diffstat (limited to 'docs/PROTOCOL.md')
| -rw-r--r-- | docs/PROTOCOL.md | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md index e9c4331..25c9250 100644 --- a/docs/PROTOCOL.md +++ b/docs/PROTOCOL.md @@ -95,7 +95,9 @@ and returns an opaque, high-entropy session id: - A token is bound to one user and one org, has scopes (`read`, `write`, `admin`) and is an independent audit actor (label shown in history). - Tokens are the intended mechanism for agents and for accountant/viewer - access. They can be revoked immediately (`token.revoke`). + access. They can be revoked immediately (`token.revoke`). Scopes are + enforced for every command, including admin commands: `backup.snapshot` + and `user.*` need a token with the `admin` scope. ### 4.3 Roles and permissions |