1. Platform
  2. Features
  3. Hierarchical RBAC
Feature Hierarchical Role-Based Access Control

Flat RBAC works until your customers have structure

As soon as you need regions, departments, or teams, flat roles stop working: permissions don't cascade, access becomes manual, and every new node means more assignments. Canopy solves this with hierarchical RBAC: roles assigned at a parent node automatically apply to all descendants.

One assignment Infinite descendants Zero migrations
Adoption path

Start flat. Add hierarchy when you need it.

Every environment starts as flat RBAC with a single root node and environment-wide roles. When your customers grow, add regions, departments, or teams. Existing assignments cascade automatically. No migrations, no data rewrites, no code changes.

Day one

A single root node with environment-wide roles. Simple by default.

Production
OwnerAdminMemberViewer
No migration
As you grow

Add regions and teams. Existing roles cascade into the new structure instantly.

Need to simplify again? Revert to flat at any time. Canopy consolidates assignments automatically.

Real-world example

A regional SaaS customer

The same org, modeled two ways. One scales with every new location; the other breaks.

The scenario

A platform with enterprise customers, regional managers, store managers, and department leads.

Regional managers need access to all offices in their region. Store managers need one location. Department leads need specific teams. Here's what that takes in each model.

Regional ManagerAll offices in regionStore ManagerOne locationDepartment LeadSpecific teams
With flat RBAC
  • Dozens of manual assignments per region
  • Every new office requires re-assignment
  • No way to scope visibility per region
With Canopy
  • Assign Regional Manager once at West Region
  • Permissions apply to every office and team below
  • No duplication, no maintenance
Downward inheritance

Assign once. It flows all the way down.

Assign a role at any node and permissions cascade to every descendant. A regional manager assigned at West Region automatically has access to every office, team, and project underneath, without a single duplicate assignment.

Cascades to every descendant

Offices, teams, and projects beneath the node inherit instantly.

New nodes inherit automatically

Add an office under a region and it adopts the regional manager's permissions. Zero configuration.

West Region · Regional Manager LIVE CASCADE
Scoped evaluation

One question. One deterministic answer.

Ask Canopy whether an identity has a permission at a node, and get an instant answer. Evaluation considers direct assignments, inherited roles, and the full hierarchy path.

Direct + inherited, resolved together

The full path from root to node is evaluated in a single pass.

One API call, deterministic result

No client-side merging. The same inputs always return the same answer.

POST /api/v1/permissions/evaluate
# Can this identity deploy at Team A?
POST /api/v1/permissions/evaluate
{
"identity_id": "9c5b1e7a-3d42-4f88-bf21-0a6e2d9c4f10",
"permission": "deployment.execute",
"scope": "node",
"node_id": "4f2d8a90-1b6c-4e35-9a77-c81e0b3a52d4"
}
 
→ 200 OK
{
"data": {
"allowed": true,
"permission": "deployment.execute",
"scope_evaluated": "node",
"effective_node_id": "4f2d8a90-1b6c-4e35-9a77-c81e0b3a52d4",
"granting_roles": ["b7e3c0d2-5f19-4a86-9c3d-2e1f8a740b65"],
"denial_reason": null
}
}
Inherited from the Regional Manager role at West Region
At a glance

Flat RBAC vs hierarchical RBAC

The same five questions, answered by each model.

Flat RBAC Hierarchical (Canopy)
Role scope Org-wide Any node in the tree
Inheritance None Permissions cascade downward
New nodes Manual re-assignment Automatic propagation
Visibility All or nothing Scoped to assignment point
Structure Breaks with growth Designed for it
Visual management

Build your hierarchy by hand. No engineering required.

Build and manage your hierarchy through the Developer Console. Drag nodes to reorder, assign identities at any level, and see inherited access at a glance.

Drag nodes to reorder the tree
Assign identities at any level
See inherited access at a glance

Ready to simplify access control?

Create an account and have authentication and hierarchical access control running today.