Authorization: who can do what

Part 4 of the visual dashboard tour. Authentication proves who someone is. Authorization decides what they're allowed to do once they're in. Atlas gives you four screens for this, from simple roles to plan-based feature gating. Pick the ones your product needs — you don't have to use all four.

Roles & permissions

Open Roles & permissions. This is the simplest model: define named roles (like Admin or Member) and the permissions each one carries.

Atlas ships with two system roles — Admin and Member — out of the box, which is enough for most products. You can add your own roles (say, Billing manager or Read-only) and tick which permissions each includes. When you put someone in an organization, you pick their role from this list.

Fine-grained access (ReBAC)

Open Fine-grained access. This is for products that need to answer questions like "can this user edit that specific document?" — permissions that depend on relationships, not just a job title.

It uses the same model that powers Google's internal permission system (Zanzibar): you define an authorization model, store relationships ("Ada is an editor of Document 42"), and your app asks Atlas to check whether an action is allowed. Most teams won't need this — but if you're building something like shared documents, folders or projects with granular sharing, it's here and it's powerful. An engineer typically sets up the model; the concept is what matters to you.

Entitlements

Open Entitlements. This is how you gate features by plan — "this capability is only for paying customers."

You define features (each a simple key like advanced_reports), then bundle them into plans. Your app checks whether a user's plan includes a feature and shows or hides it accordingly. Add a feature with the form at the bottom; build plans below that. This is the plumbing behind "upgrade to unlock."

Subscriptions

Open Subscriptions. Where Entitlements defines what each plan unlocks, Subscriptions connects those plans to real billing through Stripe.

Each plan you create here maps to a Stripe price and to a set of feature keys. When a customer subscribes, Atlas automatically stamps their account with the plan's entitlements — so the moment they pay, the paid features light up, with no extra work from you. Click New plan to create one (you'll need your Stripe account connected first).

> How these four fit together. Roles handle "what's your job here." Fine-grained access handles "which exact things can you touch." Entitlements + Subscriptions handle "what did your plan pay for." A small product might use only Roles; a mature SaaS often uses all four.

Next: the developer tools →