{
  "slug": "registry/authz",
  "title": "Registry authorization",
  "description": "Namespace, package, token, and visibility authorization in Cuitty Registry.",
  "url": "https://cuitty.com/docs/registry/authz",
  "markdown_url": "https://cuitty.com/docs/registry/authz.md",
  "json_url": "https://cuitty.com/docs/registry/authz.json",
  "frontmatter": {
    "title": "Registry authorization",
    "description": "Namespace, package, token, and visibility authorization in Cuitty Registry.",
    "order": 7,
    "section": "Registry",
    "updatedAt": "2026-06-09"
  },
  "headings": [
    {
      "depth": 2,
      "slug": "representative-objects",
      "text": "Representative objects"
    },
    {
      "depth": 2,
      "slug": "common-permissions",
      "text": "Common permissions"
    },
    {
      "depth": 2,
      "slug": "fail-closed",
      "text": "Fail closed"
    },
    {
      "depth": 2,
      "slug": "outbox-inspection",
      "text": "Outbox inspection"
    }
  ],
  "body_markdown": "Cuitty Registry uses relationship-based authorization for namespace, package, token, publish, install, and admin operations. The Registry database remains the source of package metadata; SpiceDB answers permission checks.\n\n## Representative objects\n\n- `registry_namespace`\n- `registry_package`\n- `registry_version`\n- `registry_token`\n- `registry_upload_session`\n- `organization`\n- `user`\n\n## Common permissions\n\n| Permission | Typical use |\n| --- | --- |\n| `read` | View namespace, package, version, and metadata |\n| `install` | Download packages, crates, wheels, tarballs, manifests, and layers |\n| `publish` | Upload new versions or push OCI manifests |\n| `maintain` | Yank, unyank, retag, and edit package metadata |\n| `admin` | Manage visibility, quotas, tokens, ownership, and transfers |\n\nPrivate packages may return `404` to callers without read permission. Authenticated callers with partial access should receive `403` for disallowed operations.\n\n## Fail closed\n\nSecurity-expanding writes should fail if authorization relationships cannot be committed. Examples include making a package public, granting publish permission, creating a package token, or transferring namespace ownership.\n\nSecurity-reducing writes should be retried until the authorization graph reflects the Registry database. Examples include revoking a token, making a package private, or removing a maintainer.\n\n## Outbox inspection\n\n```sql\nSELECT id, operation_kind, resource_kind, resource_id, status, attempts, last_error\nFROM registry_authz_outbox\nWHERE status IN ('pending', 'processing', 'failed_retryable', 'failed_terminal')\nORDER BY created_at ASC\nLIMIT 50;\n```\n\nReplay retryable rows with the Registry worker or maintenance command, then spot-check permissions with `zed permission check`.",
  "links_out": []
}