Roles & Permissions

Forge Core has its own custom RBAC system, independent of Better Auth's built-in admin plugin — every permission check in the API goes through this model, not Better Auth's hardcoded role strings.

Why not Better Auth's admin plugin?

Better Auth's admin plugin only recognizes its own static admin/owner role strings for authorization — it has no concept of custom roles or fine-grained permissions. Forge Core needed both, so every admin surface (member management, session revocation, API keys, and more) is gated by its own requirePermission middleware instead, checking against the model described here.

Built-in roles

• owner — a singleton, bootstrap-assigned role. Has every permission, plus role management itself (never a grantable permission — always hardcoded owner-only, so no role can escalate itself or another role).
• user — the seeded default with zero permissions.
• admin — a template role with every permission below except role management.

Additional custom roles can be created and granted any subset of the permissions below from the Roles page (/dashboard/roles), owner-only.

The permission list

One entry per (resource, action) pair — the single source of truth behind both the enforcement middleware and the Roles page's own checklist UI.