Platform access and roles
One permission model for dashboard users, normal CLI sessions, and restricted MakerTokens.
One permission model for dashboard users, normal CLI sessions, and restricted MakerTokens.
Farther Shore evaluates platform access from one canonical operation and permission catalog. Dashboard requests and normal CLI requests reload the same live organization membership and role. MakerTokens use the same operation permissions, but store a frozen, organization-scoped subset for unattended automation.
| Principal | Authority | Use it for |
|---|---|---|
| Dashboard user | Current organization role | Interactive administration |
farthershore login | The same current role as the approving user | Normal CLI work across the user's organizations and businesses |
| MakerToken | Frozen exact permissions plus ALL or selected-business scope | CI, headless agents, service automation, and shared machines |
Selecting an organization in the CLI changes command context; it does not
narrow the user's authority. Create a MakerToken under Settings →
MakerTokens when automation needs narrower or independently revocable access.
Pass it through FARTHERSHORE_TOKEN or stdin, never argv.
Every organization starts with owner, admin, and member. They are ordinary
organization-local role rows with preconfigured permission sets: their names,
descriptions, and grants can be edited. You can also create custom roles. A
custom role key is immutable after creation; assignments and invitations refer
to that key.
The primary owner is tracked separately from the editable owner role. Transfer ownership through the ownership flow before removing or reassigning the primary owner. Editing an owner role never removes that safety boundary.
Use the Team page for visual editing, or inspect exact authority from the CLI:
farthershore organization role list <organization-id> --format json
farthershore organization role show <organization-id> <role-key> --format json
farthershore organization role create <organization-id> incident-commander \
--name "Incident commander" \
--idempotency-key <persisted-organization-role-create-attempt-key> \
--permissions '["business:read","audit_log:read","business:rollback"]'
farthershore organization member-role <organization-id> <user-id> \
--role incident-commander
Role mutations are checked against the actor's live exact grants inside the same transaction as the write. A role administrator cannot add grants outside their current ceiling. Built-in roles cannot be deleted; a custom role cannot be deleted while a member or invitation references it.
Database-backed lists use the same server query contract in the dashboard and CLI. Filtering, searching, and sorting happen before pagination; the CLI does not re-sort a partial page locally.
farthershore business list \
--filter status=ACTIVE \
--search billing \
--sort updatedAt:desc
farthershore organization members <organization-id> \
--filter roleKey=incident-commander \
--sort email:asc
farthershore env list <business> \
--search preview \
--sort name:asc
--filter field=value is exact and repeatable with AND semantics. --search
is case-insensitive on the endpoint's documented text fields. --sort accepts
one allowlisted field and asc or desc. Run the command with --help for its
closed field list; unsupported fields fail before a request is sent.
A MakerToken's exact permissions and business scope are a snapshot. Later role edits do not silently widen it. The secret is shown once; store it in a secret manager. Rotate it when changing the external consumer and revoke it when the automation is retired or suspected compromised. Rotation and revocation do not change a user's browser or normal CLI authority.