Roles in your app

How your app decides what each person may do, from the team, the leader flag and the roles in Theorem's token.

Theorem decides who gets your app at all. What each of those people may do inside it is yours to decide, from the token's team claim (The token).

What you can rely on

Every token your app accepts is for your own team, because you checked aud. So team.id is always the same for your app.

Roles by ID or by name

A role has an ID, rol_ and 26 letters and digits, and a name a leader makes up. The ID stays when a leader renames the role. The name does not.

• By ID is safest: a rename changes nothing. Keep the IDs your app trusts in its own settings, read from a token of someone who holds the role.
• By name is simpler and reads well, as in the example's Finance. It stops matching if a leader renames the role, and matches again if someone makes a new role with that name.

The example's team_hours checks by name: it answers when team.leader is true or a role in team.roles is named Finance (Quick start).

Refusing inside a tool

When a person may use your app but not one of its tools, answer the call with words that say why, as team_hours does. The assistant reads them and tells the person. Answer 401 only for a token that fails its checks: it reads as your app refusing Theorem's token.

Who gets the app

The leader chooses on the Connections tab: everyone in the team, or the holders of chosen roles (Your team's connections). That is the first gate. Your rules inside the app are the second. A leader can check your app even when they don't get it, so a token may come from a leader who holds none of the app's roles: decide what a leader may do with that in mind.

Changes

Roles in a token are as they were when it was signed. A role given or taken away shows in the person's next token, within five minutes.