---
title: Registry authorization
description: Namespace, package, token, and visibility authorization in Cuitty Registry.
section: Registry
order: 7
updatedAt: 2026-06-09
slug: registry/authz
---
Cuitty Registry uses relationship-based authorization for namespace, package, token, publish, install, and admin operations. The Registry database remains the source of package metadata; SpiceDB answers permission checks.

## Representative objects

- `registry_namespace`
- `registry_package`
- `registry_version`
- `registry_token`
- `registry_upload_session`
- `organization`
- `user`

## Common permissions

| Permission | Typical use |
| --- | --- |
| `read` | View namespace, package, version, and metadata |
| `install` | Download packages, crates, wheels, tarballs, manifests, and layers |
| `publish` | Upload new versions or push OCI manifests |
| `maintain` | Yank, unyank, retag, and edit package metadata |
| `admin` | Manage visibility, quotas, tokens, ownership, and transfers |

Private packages may return `404` to callers without read permission. Authenticated callers with partial access should receive `403` for disallowed operations.

## Fail closed

Security-expanding writes should fail if authorization relationships cannot be committed. Examples include making a package public, granting publish permission, creating a package token, or transferring namespace ownership.

Security-reducing writes should be retried until the authorization graph reflects the Registry database. Examples include revoking a token, making a package private, or removing a maintainer.

## Outbox inspection

```sql
SELECT id, operation_kind, resource_kind, resource_id, status, attempts, last_error
FROM registry_authz_outbox
WHERE status IN ('pending', 'processing', 'failed_retryable', 'failed_terminal')
ORDER BY created_at ASC
LIMIT 50;
```

Replay retryable rows with the Registry worker or maintenance command, then spot-check permissions with `zed permission check`.