SEIF Local-personal and team operation
IMPLEMENTED: a local owner can use Projects, tests, Builds, the Registry and runtimes without organization setup. A self-hosted Registry holds many organizations, Projects, members, service identities and environments. The desktop connects to one Registry session over HTTPS or loopback HTTP; credentials stay in memory.
| Role | Capabilities (enforced by the Registry) |
|---|---|
| Viewer | Read Builds, environments, bindings, traces, access lists and audit |
| Developer | Viewer + register, tag, regression, promote, deploy, rollback, reproduce, and resolve/report for testing |
| Reviewer | Viewer + regression, approve, promote, deploy, rollback, reproduce |
| Admin | Everything human-grantable, including members, service identities, bindings, environment policy and break-glass |
Applications and CI are not members: they use service identities whose class bounds what they can ever hold. The full capability and endpoint matrix is generated from the route table: Authorization model. Members and identities may be limited to Projects (and identities to environments); tokens cannot cross organizations. Separation of duties is optional per environment.
FUTURE: SSO, invitation/email workflows, remote collaborative Project editing.