RBAC API

Table of Contents

• upsquad/rbac/v1/rbac.proto

  • AssignRoleRequest

  • AssignRoleResponse

  • CapabilityMeta

  • CapabilityVerdict

  • ClearanceLevel

  • CreateRoleRequest

  • CreateRoleResponse

  • DeleteRoleRequest

  • DeleteRoleResponse

  • GetClearanceLegendRequest

  • GetClearanceLegendResponse

  • GetRoleRequest

  • GetRoleResponse

  • ListAssignmentsRequest

  • ListAssignmentsResponse

  • ListPermissionsRequest

  • ListPermissionsResponse

  • ListRolesRequest

  • ListRolesResponse

  • ListSimulatableResourcesRequest

  • ListSimulatableResourcesResponse

  • MemberCapabilityAccess

  • Permission

  • PermissionDelta

  • PreviewClearanceChangeRequest

  • PreviewClearanceChangeResponse

  • ReasoningRef

  • ReasoningStep

  • ResolveEffectivePermissionsRequest

  • ResolveEffectivePermissionsResponse

  • ResolveMemberAccessRequest

  • ResolveMemberAccessResponse

  • ResolveTeamAccessRequest

  • ResolveTeamAccessResponse

  • RevokeRoleRequest

  • RevokeRoleResponse

  • Role

  • RoleAssignment

  • SimulatableResource

  • SimulateAccessRequest

  • SimulateAccessResponse

  • UnblockHint

  • UpdateRolePermissionsRequest

  • UpdateRolePermissionsResponse

  • AccessReason

  • AccessVerdict

  • ReasoningKind

  • ResourceGroup

  • ScopeType

  • RbacService

• Scalar Value Types

Top

upsquad/rbac/v1/rbac.proto

AssignRoleRequest

AssignRoleRequest creates a scoped role assignment.

Field	Type	Label	Description
member_id	string		member_id receives the grant.
role_id	string		role_id is the role to grant.
scope_type	ScopeType		scope_type identifies the grant's scope.
scope_id	string		scope_id is the unit or member id; ignored when scope_type=GLOBAL.

AssignRoleResponse

AssignRoleResponse returns the new assignment.

Field	Type	Label	Description
assignment	RoleAssignment		assignment is the newly created role assignment.

CapabilityMeta

CapabilityMeta is one column header in the access grid: the capability catalog entry plus its clearance floor. Returned alongside the grid so the matrix UI renders columns + floors without a second fetch.

Field	Type	Label	Description
key	string		key is the canonical capability key, e.g. "code-write".
label	string		label is the human-readable column header, e.g. "Write Code".
description	string		description is the one-line explainer surfaced in the column tooltip.
min_clearance	int32		min_clearance is the clearance floor (1..5) the capability requires.

CapabilityVerdict

CapabilityVerdict is one cell in the access grid: the effective access of a member for a single capability.

Field	Type	Label	Description
capability	string		capability is the capability key this verdict is for, e.g. "deploy".
allowed	bool		allowed is true iff reason == ACCESS_REASON_OK.
reason	AccessReason		reason explains the verdict (ok

ClearanceLevel

ClearanceLevel describes one tier of the 5-level clearance hierarchy plus the count of members from the caller's tenant currently sitting at that tier. Labels and descriptions are platform-canonical (PRD §P4.5.1) — the server is the single source of truth so frontends can never drift.

Field	Type	Label	Description
level	int32		level is the numeric tier in the closed range [1, 5]. The platform never introduces L0 or L6; if you need a sentinel use the absence of an entry rather than a magic value.
label	string		label is the canonical human-readable tier name, e.g. "L1 Observer" or "L5 Admin". UI surfaces render this verbatim — they MUST NOT recompute it from the level integer.
description	string		description is the canonical one-liner explaining what members at this tier can do. UI surfaces use this in tooltips and the legend strip on the redesigned Org page.
member_count	int32		member_count is the tenant-scoped count of non-deleted members (status='active') currently assigned to this clearance level. RLS on the members table guarantees the count cannot bleed across tenants. A tier with no members returns 0 rather than being omitted.

CreateRoleRequest

CreateRoleRequest creates a new custom role.

Field	Type	Label	Description
slug	string		slug is the machine identifier, unique per tenant.
display_name	string		display_name is the human-readable label.
description	string		description is a one-line summary.
permission_ids	string	repeated	permission_ids is the initial permission set.

CreateRoleResponse

CreateRoleResponse returns the created role.

Field	Type	Label	Description
role	Role		role is the newly created role.

DeleteRoleRequest

DeleteRoleRequest identifies a role for deletion.

Field	Type	Label	Description
id	string		id is the role id.

DeleteRoleResponse

DeleteRoleResponse acknowledges deletion.

GetClearanceLegendRequest

GetClearanceLegendRequest has no fields — the legend is implicit in the caller's authenticated tenant context (org_id is read from the scope middleware, identical to every other RPC). Reserved for future filters (e.g. include_zero_counts) so the message exists today.

GetClearanceLegendResponse

GetClearanceLegendResponse returns the five-level clearance legend annotated with per-tenant member counts.

Field	Type	Label	Description
levels	ClearanceLevel	repeated	levels are returned in ascending order (level=1..5). The slice is always exactly five entries; tenants with zero members at a level see member_count=0 rather than a missing entry.

GetRoleRequest

GetRoleRequest identifies a role by id.

Field	Type	Label	Description
id	string		id is the role id.

GetRoleResponse

GetRoleResponse returns a single role with its permissions.

Field	Type	Label	Description
role	Role		role is the requested role.

ListAssignmentsRequest

ListAssignmentsRequest lists role assignments with optional filters.

Field	Type	Label	Description
member_id	string		member_id filters to a specific member; empty matches all.
role_id	string		role_id filters to a specific role; empty matches all.
scope_type	ScopeType		scope_type filters by scope type; SCOPE_TYPE_UNSPECIFIED matches all.
scope_id	string		scope_id filters by scope id; empty matches all.

ListAssignmentsResponse

ListAssignmentsResponse returns matching assignments.

Field	Type	Label	Description
assignments	RoleAssignment	repeated	assignments is the list of matching role assignments.

ListPermissionsRequest

ListPermissionsRequest requests the permission catalog.

Field	Type	Label	Description
category	string		category optionally filters by permission category prefix.

ListPermissionsResponse

ListPermissionsResponse returns the permission catalog.

Field	Type	Label	Description
permissions	Permission	repeated	permissions is the ordered catalog.

ListRolesRequest

ListRolesRequest requests roles.

Field	Type	Label	Description
include_builtin	bool		include_builtin includes platform-owned roles in the response.
include_custom	bool		include_custom includes tenant-owned custom roles in the response.

ListRolesResponse

ListRolesResponse returns roles.

Field	Type	Label	Description
roles	Role	repeated	roles is the combined list of matching roles.

ListSimulatableResourcesRequest

ListSimulatableResourcesRequest has no fields — the catalog is platform-canonical and tenant-agnostic. Reserved for future filters (e.g. by group) so the message exists today.

ListSimulatableResourcesResponse

ListSimulatableResourcesResponse returns the simulator resource catalog. The slice is stable across calls; frontends should cache it per session (and ideally per release).

Field	Type	Label	Description
resources	SimulatableResource	repeated	resources is the ordered catalog of simulator options. Order is semantically meaningful: the UI groups them by group field but preserves catalog order within a group.

MemberCapabilityAccess

MemberCapabilityAccess is one row in the access grid: a member and their verdict for every capability in the catalog.

Field	Type	Label	Description
member_id	string		member_id is the member this row resolves.
member_type	string		member_type is 'human' or 'agent'. Humans and agents resolve through the identical path (PRD #1206 decision 3); this field is for rendering only.
display_name	string		display_name is the member's name, surfaced so the UI renders rows without a second member lookup.
clearance	int32		clearance is the member's clearance tier (1..5), surfaced so the UI can explain clearance_floor verdicts inline.
verdicts	CapabilityVerdict	repeated	verdicts holds one entry per capability in the catalog, ordered to match the response's capabilities field.

Permission

Permission is a catalog entry describing a discrete capability in the system.

Field	Type	Label	Description
id	string		id is the canonical key, e.g. "guardrails.edit".
category	string		category groups permissions for UI and filter purposes, e.g. "guardrails".
description	string		description is a human-readable one-liner.

PermissionDelta

PermissionDelta is one entry in a "what changes" ladder. Each delta represents a single permission key whose grant state differs between the current and proposed clearance tiers. A grant can be GAINED (before='', after=label), REVOKED (before=label, after=''), or CHANGED (both populated, content differs).

Field	Type	Label	Description
permission_id	string		permission_id is the canonical permission key, e.g. "data.customer_pii" or "comms.exec_channels". When the change is purely a clearance-tier grant (no underlying RBAC permission row), permission_id mirrors a clearance-grant id like "clearance.internal.docs".
before	string		before is the human-readable description of the grant at the current clearance, or empty when the permission is brand new.
after	string		after is the human-readable description of the grant at the new clearance, or empty when the permission is being revoked.

PreviewClearanceChangeRequest

PreviewClearanceChangeRequest identifies the member and the proposed new clearance tier. No mutation occurs; the call is safe to issue repeatedly while the operator slides through tiers in the Edit modal.

Field	Type	Label	Description
member_id	string		member_id is the target member whose clearance would change.
new_clearance	int32		new_clearance is the proposed tier in [1, 5].

PreviewClearanceChangeResponse

PreviewClearanceChangeResponse describes the effect of the proposed change so the Edit modal can render the "what changes when clearance becomes X" ladder banner.

Field	Type	Label	Description
requires_approval	bool		requires_approval is true when the change would route through the approval system — either because new_clearance is higher than the member's current clearance, or because the caller's own clearance sits below new_clearance (you can't unilaterally promote past yourself).
approver_role	string		approver_role is the slug of the role the approval router would require (e.g. "owner", "team_admin"). Empty when requires_approval is false.
what_changes	PermissionDelta	repeated	what_changes enumerates each grant that flips on the move. before and after carry the same shape — a human-readable label sourced from the canonical clearance grant matrix — so the UI doesn't have to recompute it.
current_clearance	int32		current_clearance is the member's existing tier, surfaced so the UI can render the before/after strap without a second lookup.

ReasoningRef

ReasoningRef points at a specific clearance tier or guardrail the reasoning step refers to. Either field is present at a time; guardrail_id and clearance_level are mutually exclusive per ref.

Field	Type	Label	Description
guardrail_id	string		guardrail_id is a guardrail handle, e.g. "GR-01". Empty when the ref points at a clearance tier instead.
clearance_level	int32		clearance_level is a tier (1..5). Zero when the ref points at a guardrail instead.

ReasoningStep

ReasoningStep is one entry in the simulator's reasoning chain.

Field	Type	Label	Description
kind	ReasoningKind		kind labels the step.
text	string		text is the human-readable explanation rendered verbatim in the modal's reasoning column.
references	ReasoningRef	repeated	references identifies the clearance tier(s) or guardrail(s) the step refers to so the UI can deep-link to docs / settings.

ResolveEffectivePermissionsRequest

ResolveEffectivePermissionsRequest asks for the effective permission set granted to a member for operations targeting a given scope.

Field	Type	Label	Description
member_id	string		member_id is the subject of the resolution.
target_scope_type	ScopeType		target_scope_type identifies the target scope.
target_scope_id	string		target_scope_id is the target unit or member id; ignored for GLOBAL.

ResolveEffectivePermissionsResponse

ResolveEffectivePermissionsResponse returns the union of permission ids granted to the member at the target scope.

Field	Type	Label	Description
permission_ids	string	repeated	permission_ids is the sorted, de-duplicated list of granted permissions.

ResolveMemberAccessRequest

ResolveMemberAccessRequest asks for a single member's capability verdicts at a unit scope.

Field	Type	Label	Description
member_id	string		member_id is the subject of the resolution.
unit_id	string		unit_id is the org_unit scope the capabilities resolve against.

ResolveMemberAccessResponse

ResolveMemberAccessResponse returns the member's row plus the capability catalog meta (so a standalone panel needs only this one call).

Field	Type	Label	Description
capabilities	CapabilityMeta	repeated	capabilities are the catalog column headers (same shape + order as ResolveTeamAccessResponse.capabilities).
access	MemberCapabilityAccess		access is the member's per-capability verdict row.

ResolveTeamAccessRequest

ResolveTeamAccessRequest asks for the whole member x capability grid of an org_unit.

Field	Type	Label	Description
unit_id	string		unit_id is the org_unit (team) whose members-matrix to resolve.

ResolveTeamAccessResponse

ResolveTeamAccessResponse returns the access grid for the unit.

Field	Type	Label	Description
unit_id	string		unit_id echoes the resolved unit.
capabilities	CapabilityMeta	repeated	capabilities are the catalog column headers, ordered by ascending floor then key. Each member's verdicts align to this order.
members	MemberCapabilityAccess	repeated	members is one row per non-deleted unit member (humans + agents), ordered by member_type then display_name.

RevokeRoleRequest

RevokeRoleRequest identifies an assignment for removal.

Field	Type	Label	Description
assignment_id	string		assignment_id is the assignment id.

RevokeRoleResponse

RevokeRoleResponse acknowledges revocation.

Role

Role is a named bundle of permissions, either built-in (platform-owned) or custom (tenant-owned).

Field	Type	Label	Description
id	string		id is the stable UUID of the role.
org_id	string		org_id is empty for built-in roles; set for tenant custom roles.
slug	string		slug is the canonical machine identifier, e.g. "team_admin".
display_name	string		display_name is the human-readable label.
description	string		description explains the role's purpose.
is_builtin	bool		is_builtin marks platform-owned immutable roles.
permission_ids	string	repeated	permission_ids enumerates the permissions this role grants.
created_at	google.protobuf.Timestamp		created_at is the timestamp the role was created.

RoleAssignment

RoleAssignment binds a (member, role) pair at a specific scope.

Field	Type	Label	Description
id	string		id is the stable UUID of the assignment.
member_id	string		member_id receives the grant.
role_id	string		role_id is the granted role.
scope_type	ScopeType		scope_type identifies whether the grant is global, unit-scoped, or member-scoped.
scope_id	string		scope_id is the unit id (for org_unit) or member id (for member); empty when scope_type=SCOPE_TYPE_GLOBAL.
granted_by	string		granted_by is the member id of the actor that performed the grant.
created_at	google.protobuf.Timestamp		created_at is the grant timestamp.

SimulatableResource

SimulatableResource is one entry in the catalog returned by ListSimulatableResources.

Field	Type	Label	Description
id	string		id is the stable canonical identifier, e.g. "customer-pii". UI surfaces use this as the dropdown key; the SimulateAccess RPC takes the same id verbatim.
label	string		label is the human-readable resource name, e.g. "Customer PII".
group	ResourceGroup		group is the column / category the modal renders the entry under.
required_clearance	int32		required_clearance is the minimum clearance tier (1..5) a member must hold to even be eligible for the resource. Guardrails (see SimulateAccess) layer on top of the clearance gate.
description	string		description is the one-line explainer surfaced under the label, e.g. "Names, emails, phone numbers, addresses".
icon	string		icon is the design-bundle glyph string (single character) the modal renders to the left of the label. Servers may return empty when no icon is configured.
guardrail_ids	string	repeated	guardrail_ids enumerates the guardrail handles that overlay the resource (e.g. "GR-01" for refund ceilings). Empty when the resource is gated purely on clearance.

SimulateAccessRequest

SimulateAccessRequest identifies the (member, resource) pair to evaluate.

Field	Type	Label	Description
member_id	string		member_id is the subject — whose clearance + active guardrails we simulate against.
resource_id	string		resource_id is the catalog id from ListSimulatableResources.

SimulateAccessResponse

SimulateAccessResponse returns the verdict + reasoning chain.

Field	Type	Label	Description
verdict	AccessVerdict		verdict is ALLOWED or BLOCKED.
reasoning	ReasoningStep	repeated	reasoning is the ordered chain the modal renders top-to-bottom.
unblock_hint	UnblockHint		unblock_hint is set ONLY when verdict == ACCESS_VERDICT_BLOCKED.

UnblockHint

UnblockHint is the smallest mutation that would flip the verdict from BLOCKED to ALLOWED. Returned only when verdict is BLOCKED.

Field	Type	Label	Description
needed_clearance	int32		needed_clearance is the clearance tier (1..5) the member would need to be promoted to.
edit_target	string		edit_target is a frontend route hint pointing at the form / modal that effects the mutation, e.g. "member.clearance".

UpdateRolePermissionsRequest

UpdateRolePermissionsRequest replaces the permission set of a custom role.

Field	Type	Label	Description
role_id	string		role_id is the target role.
permission_ids	string	repeated	permission_ids is the new permission set (replaces existing).

UpdateRolePermissionsResponse

UpdateRolePermissionsResponse returns the updated role.

Field	Type	Label	Description
role	Role		role is the updated role.

AccessReason

AccessReason explains a single capability verdict. Per PRD #1206 only the authorization axes are surfaced here — the credential gate (decision 2) is out of scope for this resolution surface and is sourced separately.

Name	Number	Description
ACCESS_REASON_UNSPECIFIED	0	ACCESS_REASON_UNSPECIFIED is the zero value; never returned by the server.
ACCESS_REASON_OK	1	ACCESS_REASON_OK — both gates pass: clearance >= floor AND role grants the capability. allowed is true.
ACCESS_REASON_CLEARANCE_FLOOR	2	ACCESS_REASON_CLEARANCE_FLOOR — the member's clearance is below the capability's min_clearance floor. allowed is false. Checked first, so a member failing BOTH gates reports clearance_floor (mirrors the matrix UI mock resolver order).
ACCESS_REASON_ROLE_MISSING	3	ACCESS_REASON_ROLE_MISSING — clearance clears the floor but no role the member holds (at the applicable scope) grants the capability. allowed is false.

AccessVerdict

AccessVerdict is the binary outcome of an access simulation.

Name	Number	Description
ACCESS_VERDICT_UNSPECIFIED	0	ACCESS_VERDICT_UNSPECIFIED is the zero value; never returned by the server.
ACCESS_VERDICT_ALLOWED	1	ACCESS_VERDICT_ALLOWED — the member can access the resource. The reasoning chain may still surface guardrail overlays the operator should be aware of (e.g. "still escalates to Finance Lead").
ACCESS_VERDICT_BLOCKED	2	ACCESS_VERDICT_BLOCKED — the member cannot access the resource. The reasoning chain explains why and unblock_hint surfaces the smallest change that would flip the verdict to ALLOWED.

ReasoningKind

ReasoningKind labels each step of the simulator's reasoning chain.

Name	Number	Description
REASONING_KIND_UNSPECIFIED	0	REASONING_KIND_UNSPECIFIED is the zero value.
REASONING_KIND_CLEARANCE_OK	1	REASONING_KIND_CLEARANCE_OK — the member's clearance is at or above the resource's required_clearance.
REASONING_KIND_CLEARANCE_INSUFFICIENT	2	REASONING_KIND_CLEARANCE_INSUFFICIENT — the member's clearance is below the resource's required_clearance.
REASONING_KIND_GUARDRAIL_OVERLAY	3	REASONING_KIND_GUARDRAIL_OVERLAY — a guardrail still applies to the resource (typically informational; the operator may still need human escalation despite the clearance verdict).

ResourceGroup

ResourceGroup buckets simulator resources for the modal's three-column layout. The three values mirror the DATA / COMMUNICATION / ACTION headers on the redesigned "What Can They See?" modal.

Name	Number	Description
RESOURCE_GROUP_UNSPECIFIED	0	RESOURCE_GROUP_UNSPECIFIED is the zero value; never returned by the server for catalog entries.
RESOURCE_GROUP_DATA	1	RESOURCE_GROUP_DATA covers data surfaces (PII, payment data, source code, internal docs).
RESOURCE_GROUP_COMMUNICATION	2	RESOURCE_GROUP_COMMUNICATION covers messaging surfaces (executive Slack channels, mass external recipients lists).
RESOURCE_GROUP_ACTION	3	RESOURCE_GROUP_ACTION covers mutation / approval surfaces (refunds, vendor approvals, org-structure edits, branch merges).

ScopeType

ScopeType identifies the scope of a role assignment. 'global' applies platform-wide within the tenant; 'org_unit' scopes to a specific unit and (transitively) all its descendants; 'member' scopes to a specific member (rare, used for self-service grants).

Name	Number	Description
SCOPE_TYPE_UNSPECIFIED	0	SCOPE_TYPE_UNSPECIFIED is the zero value. Callers must set a real scope.
SCOPE_TYPE_GLOBAL	1	SCOPE_TYPE_GLOBAL applies to every resource in the tenant.
SCOPE_TYPE_ORG_UNIT	2	SCOPE_TYPE_ORG_UNIT applies to the target org_unit and its descendants.
SCOPE_TYPE_MEMBER	3	SCOPE_TYPE_MEMBER applies to a specific member only.

RbacService

RbacService manages permissions, roles, role assignments, and effective permission resolution for the current tenant.

--- Permission catalog ---

Method Name	Request Type	Response Type	Description
ListPermissions	ListPermissionsRequest	ListPermissionsResponse	ListPermissions returns the platform permission catalog (optionally filtered by category). Permissions are platform-owned and seeded from deploy/seeds/permissions.yaml at service boot.
ListRoles	ListRolesRequest	ListRolesResponse	ListRoles returns built-in and/or custom (tenant-scoped) roles with their permission sets. Built-in roles have org_id empty and is_builtin=true.
GetRole	GetRoleRequest	GetRoleResponse	GetRole retrieves a single role by id with its permission set.
CreateRole	CreateRoleRequest	CreateRoleResponse	CreateRole creates a custom role scoped to the caller's tenant. Rejects attempts to create a role with is_builtin=true or with a slug that collides with a built-in role.
UpdateRolePermissions	UpdateRolePermissionsRequest	UpdateRolePermissionsResponse	UpdateRolePermissions replaces the permission set of a custom role. Built-in roles are immutable — attempting to edit one returns FAILED_PRECONDITION.
DeleteRole	DeleteRoleRequest	DeleteRoleResponse	DeleteRole deletes a custom role. Built-in roles cannot be deleted. Fails if the role has any active assignments; caller must revoke first.
AssignRole	AssignRoleRequest	AssignRoleResponse	AssignRole grants a role to a member at a given scope. Invalidates the affected member's permission cache in-process and publishes 'rbac_role_changed' on Redis pub/sub for multi-pod fan-out.
RevokeRole	RevokeRoleRequest	RevokeRoleResponse	RevokeRole soft-removes an assignment (sets deleted_at). Cache invalidated immediately on both local pod and remote pods via Redis pub/sub.
ListAssignments	ListAssignmentsRequest	ListAssignmentsResponse	ListAssignments returns role assignments, optionally filtered by member_id, role_id, or scope.
ResolveEffectivePermissions	ResolveEffectivePermissionsRequest	ResolveEffectivePermissionsResponse	ResolveEffectivePermissions returns the union of permission ids granted to member_id for operations targeting (target_scope_type, target_scope_id). Results are LRU-cached per (member_id, scope) with TTL 60s.
GetClearanceLegend	GetClearanceLegendRequest	GetClearanceLegendResponse	GetClearanceLegend returns the canonical 5-level clearance legend (label + description per PRD §P4.5.1) annotated with the per-tenant count of members currently sitting at each level. The legend itself is platform-static — labels and descriptions never change per tenant — but member_count is tenant-scoped (filtered by the caller's org via the same RLS-bound transaction every other RPC uses). Source for GAP-22 in tracker #1031: the redesigned Org page renders a legend strip and the labels MUST come from the server (5-Level Clearance is a platform tenet — the frontend may not redefine it).
PreviewClearanceChange	PreviewClearanceChangeRequest	PreviewClearanceChangeResponse	PreviewClearanceChange computes the effect of changing a member's clearance to new_clearance WITHOUT mutating any state. Powers the "what changes when clearance becomes X" ladder banner on the Edit member modal (redesign 2026-04). The response tells the UI three things: (1) does the change require approval routing, (2) which role would need to approve it, (3) what individual permissions are gained / revoked. RLS-scoped — the member must belong to the caller's tenant or NOT_FOUND is returned.
ListSimulatableResources	ListSimulatableResourcesRequest	ListSimulatableResourcesResponse	ListSimulatableResources returns the catalog of resources / actions the "What Can They See?" simulator modal lets operators pick from. The catalog is platform-canonical (10 entries today, sourced from the redesign-2026-04 design bundle) — frontends MUST NOT hard-code the list. Cache aggressively: the catalog is immutable per release.
SimulateAccess	SimulateAccessRequest	SimulateAccessResponse	SimulateAccess answers "would this member be allowed to access this resource?" with a verdict pill plus a step-by-step reasoning chain. The reasoning chain walks the member's clearance against the resource's required_clearance, then layers any guardrails that apply (even when the verdict is ALLOWED, guardrails may surface as informational overlay steps so operators see "still escalates to Finance Lead"). When BLOCKED, an unblock_hint surfaces the specific clearance bump the member would need.
ResolveTeamAccess	ResolveTeamAccessRequest	ResolveTeamAccessResponse	ResolveTeamAccess computes the per-member, per-capability effective access grid for an org_unit (the Team workspace members-matrix). For every member of the unit and every capability in the catalog it returns a verdict {allowed, reason}, where effective access (PRD #1206 decision 1) is clearance(M) >= floor(capability) AND role(M) grants capability. The whole grid is returned in ONE call (capabilities meta + all members x capabilities) so the matrix UI never N+1s. Reasons cover the authorization axes only (clearance_floor
ResolveMemberAccess	ResolveMemberAccessRequest	ResolveMemberAccessResponse	ResolveMemberAccess computes the per-capability verdict vector for a single (member, unit) pair — the same resolution ResolveTeamAccess runs per row, exposed for the single-member effective-access panel. RLS- scoped; NOT_FOUND when the member is invisible to the caller's tenant.

Scalar Value Types

.proto Type	Notes	C++	Java	Python	Go	C#	PHP	Ruby
double		double	double	float	float64	double	float	Float
float		float	float	float	float32	float	float	Float
int32	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
int64	Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead.	int64	long	int/long	int64	long	integer/string	Bignum
uint32	Uses variable-length encoding.	uint32	int	int/long	uint32	uint	integer	Bignum or Fixnum (as required)
uint64	Uses variable-length encoding.	uint64	long	int/long	uint64	ulong	integer/string	Bignum or Fixnum (as required)
sint32	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sint64	Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int64s.	int64	long	int/long	int64	long	integer/string	Bignum
fixed32	Always four bytes. More efficient than uint32 if values are often greater than 2^28.	uint32	int	int	uint32	uint	integer	Bignum or Fixnum (as required)
fixed64	Always eight bytes. More efficient than uint64 if values are often greater than 2^56.	uint64	long	int/long	uint64	ulong	integer/string	Bignum
sfixed32	Always four bytes.	int32	int	int	int32	int	integer	Bignum or Fixnum (as required)
sfixed64	Always eight bytes.	int64	long	int/long	int64	long	integer/string	Bignum
bool		bool	boolean	boolean	bool	bool	boolean	TrueClass/FalseClass
string	A string must always contain UTF-8 encoded or 7-bit ASCII text.	string	String	str/unicode	string	string	string	String (UTF-8)
bytes	May contain any arbitrary sequence of bytes.	string	ByteString	str	[]byte	ByteString	string	String (ASCII-8BIT)