Role-Based Access Control
Admin, Maintainer, and Viewer roles with fine-grained OAuth2-style scopes.
- Three built-in roles: Admin (full access including user management), Maintainer (read/write URLs and analytics), Viewer (read-only)
- Define custom roles with narrower scope sets through the Roles API
- Every permission check resolves to an explicit scope (for example users:admin or urls:write), not a role-name check