Struct RoleBasedAccessControl 

pub struct RoleBasedAccessControl { /* private fields */ }

Role-based access control (RBAC) for account components.

Instead of having one account holding every privilege, privileges are split into named roles (for example MINTER, BURNER, PAUSER), and each procedure is guarded against the caller’s role membership. It allows role assignment with domain isolation to minimize the scope of damage from a compromised role.

Security considerations

Access control is based on the note sender (the account ID that created the note), which authenticates which account created a note but not the code that executed when it was created. It is meaningful only when every account registered as a role member enforces strong authentication. Registering a permissionless account (for example one using no_auth) as a role member provides no access restriction: anyone can make such an account emit a note with an arbitrary script root and that account’s ID as sender, defeating the sender check.

Administration model

Role administration is fully role-based. Every role has an effective admin role: its configured delegated admin when set, otherwise the built-in ADMIN role. Only members of a role’s effective admin role may grant, revoke, or re-point (set_role_admin) that role.

A component defined any role is configured with a live administration path for it (see builder), which for a role left with the default admin means members of the ADMIN role. The ADMIN role administers itself, so ADMIN membership can be granted, revoked, and renounced through the standard API.

Role hierarchy and exclusive delegation

Every role may have its admin delegated to another role via set_role_admin. Accounts holding a role’s admin role are authorized to grant and revoke that role. For example, accounts holding MINTER_ADMIN can manage the MINTER role but have no authority over BURNER or PAUSER.

Delegation is exclusive: once a role’s admin is delegated to another role, the ADMIN role loses all authority over it (grant, revoke, and further set_role_admin are then gated on the delegated admin). This lets a sensitive role — say a token issuer — be placed exclusively under a dedicated admin role and kept out of reach of the general administrator. To hand authority back, the current delegated admin re-points the role (passing 0 reverts it to the ADMIN role).

Both members and delegated admins can be configured at construction (see RoleConfig), which establishes exclusive delegation atomically: a role configured with a delegated admin is never reachable by ADMIN, not even transiently. Reaching the same configuration on an existing account requires the sequence below, during which ADMIN still administers the role. That window is also the only chance to repair a mistyped or hostile admin role, so a configured delegation must be verified before account creation: initialization proves that some role can administer the delegated role, never that the deployer controls it.

This supports a fully decentralized configuration: for each delegated role, (1) grant the dedicated admin role’s members, (2) make it self-administering (set_role_admin(X, X) — only safe once X has members), (3) delegate the managed role to it, and (4) revoke or renounce all bootstrap ADMIN members, waiting for each step to commit before issuing the next. Emptying ADMIN is permanent and forfeits every ADMIN-defaulted capability (the Authority procedure→role map is fixed at account creation), so an account whose gated procedures are not all mapped to live roles must never empty ADMIN. A self-administering role has no quorum — any single member can evict the rest — so its members should themselves be strongly authenticated (e.g. multisig) accounts.

The delegated admin of a role can itself be any role, including one that it admins. Circular relationships are possible but should be designed with care, since each role can then revoke the other. Only delegate to a role that already has members, and treat emptying a role’s effective admin like ownership renouncement: the role stays unmanageable until its effective admin is repopulated — for a self-administering role (including ADMIN), never.

Role semantics

A role is considered to exist when it has at least one member. Granting the first member creates the role; revoking the last member removes it. As a consequence, set_role_admin(A, B) stores the admin relationship in storage but does not make role A exist until a member is granted. Once the last member of A is revoked, get_role_member_count(A) returns 0, though the admin configuration is retained and will apply the next time a member is granted.

Membership lookup

has_role procedure is the primary guard used by procedures that assert the caller’s role membership. get_role_member_count returns the number of accounts holding a role.

Role symbol format

A RoleSymbol encodes up to 12 uppercase ASCII characters with underscores into a single field element using the same packing as the token symbol type. Examples: MINTER, MINTER_ADMIN, PAUSER. The zero field element is reserved and cannot be used as a role symbol; attempting to do so panics with ERR_ROLE_SYMBOL_ZERO.

Usage

Guarding a procedure in MASM so that only members of MINTER can call it:

pub proc mint
    push.MINTER_ROLE_SYMBOL
    exec.::miden::standards::access::rbac::assert_sender_has_role
    # add mint logic
end

Implementations

impl RoleBasedAccessControl

pub fn builder() -> RoleBasedAccessControlBuilder

Returns an RBAC component initialized with the given roles, each carrying its members and its delegated admin (see RoleConfig).

Roles are added with the role and roles setters. Initializing no role at all is allowed and produces a component with no roles and no administrator.

Errors

Returns an error if:

• the same role is specified more than once.
• a role is configured with neither members nor a delegated admin.
• a role’s member count exceeds u32::MAX.
• a role’s effective admin — its delegated admin, or ADMIN when unset — can never hold members, which would leave the role permanently unmanageable. Setting an operational role without defining ADMIN is the common case: ADMIN administers itself, so nothing can ever populate it.

impl RoleBasedAccessControl

pub const NAME: &'static str = "miden::standards::access::rbac"

The name of the component.

pub const ADMIN_ROLE: &'static str = "ADMIN"

The built-in default admin role symbol. A role whose delegated admin is unset is administered by members of this role.

Keep in sync with the ADMIN_ROLE constant in asm/standards/access/rbac.masm.

pub fn with_admins( admins: impl IntoIterator<Item = AccountId>, ) -> Result<RoleBasedAccessControl, RoleBasedAccessControlError>

Returns an RBAC component whose built-in ADMIN role is configured with admins and which defines no other role.

Errors

Returns an error if admins is empty, since the resulting component would have no administrator. Build such a component with the builder instead.

pub fn admin_role() -> RoleSymbol

Returns the built-in default admin RoleSymbol.

pub const fn name() -> AccountComponentName

Returns the canonical AccountComponentName of this component.

pub fn code() -> &'static AccountComponentCode

Returns the AccountComponentCode of this component.

pub fn role_config_slot() -> &'static StorageSlotName

Returns the storage slot name for the per-role config map.

pub fn role_membership_slot() -> &'static StorageSlotName

Returns the storage slot name for the per-role membership map.

pub fn role_config_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the schema entry for the per-role config map.

pub fn role_membership_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the schema entry for the per-role membership map.

pub fn component_metadata() -> AccountComponentMetadata

Returns the AccountComponentMetadata describing this component.

Trait Implementations

impl Clone for RoleBasedAccessControl

fn clone(&self) -> RoleBasedAccessControl

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RoleBasedAccessControl

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for RoleBasedAccessControl

impl From<RoleBasedAccessControl> for AccountComponent

fn from(rbac: RoleBasedAccessControl) -> AccountComponent

Converts to this type from the input type.

impl PartialEq for RoleBasedAccessControl

fn eq(&self, other: &RoleBasedAccessControl) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for RoleBasedAccessControl