MIR-891

Implement app-level authorization (RFD-67)

Open public

phinze Opened Mar 26, 2026 Updated Jul 24, 2026

Extend Miren's authorization from cluster-level to app-level granularity per RFD-67. Enables multi-user clusters where users are scoped to their own apps. Primary motivating use case is miren.club. Requires work on both cloud side and runtime side.

Key work areas from the RFD:

Phase 1 — Foundation: Add created_by to app entity, extend RBAC evaluator with Scope/Instance/Owner, gate EntityAccess behind cluster:admin
Phase 2 — App-level authorization: Authorization mapping layer, list filtering, migrate Tier 2 commands
Phase 3 — Standalone policy: File-based policy provider for standalone clusters (policy.toml + identities.toml)
Phase 4 — Cloud + dogfooding: Cloud UI for app-level rules, miren.club dogfooding

RFD: mirendev/rfd#111