Entitlements
Full RBAC entitlement verb catalog - which actions each role can perform in Rising Tide Protocol.
Every entitlement name uses one of six verbs - CREATE_*, MANAGE_*, VIEW_*, COLLECT_*, SUBMIT_*, RSVP_*. This page lists every entitlement and which roles hold it.
Roles
Five roles ship seeded. The structure is flat - no inheritance. A user's effective entitlements are the union of the grants from every role they hold.
| Role | Granted | Holds |
|---|---|---|
| Member | Auto-granted on first auth | Participation only |
| Open Beta | Attached to beta invites | Participation + page creation |
| Artist | Manual grant | Participation + asset authoring |
| Early Adopter | Manual grant | Participation + page creation |
| Admin | Manual grant | Everything |
Grants matrix
| Entitlement | Member | Open Beta | Artist | Early Adopter | Admin |
|---|---|---|---|---|---|
COLLECT_EDITIONS | Yes | Yes | Yes | Yes | Yes |
RSVP_EVENTS | Yes | Yes | Yes | Yes | Yes |
SUBMIT_BRACKETS | Yes | Yes | Yes | Yes | Yes |
CREATE_ASSETS | No | No | Yes | No | Yes |
CREATE_PAGES | No | Yes | No | Yes | Yes |
CREATE_EVENTS | No | No | No | No | Yes |
CREATE_BRACKETS | No | No | No | No | Yes |
CREATE_GAMES | No | No | No | No | Yes |
VIEW_ADMIN_PANEL | No | No | No | No | Yes |
MANAGE_ACCOUNTS | No | No | No | No | Yes |
MANAGE_LISTINGS | No | No | No | No | Yes |
MANAGE_ROLES | No | No | No | No | Yes |
MANAGE_CONTRACTS | No | No | No | No | Yes |
MANAGE_ACHIEVEMENTS | No | No | No | No | Yes |
MANAGE_CHALLENGES | No | No | No | No | Yes |
MANAGE_TEMPLATES | No | No | No | No | Yes |
MANAGE_FUNDING_GROUPS | No | No | No | No | Yes |
MANAGE_TOURNAMENTS | No | No | No | No | Yes |
MANAGE_STICKERS | No | No | No | No | Yes |
MANAGE_PRODUCT_TYPES | No | No | No | No | Yes |
During the testnet beta, CREATE_EVENTS, CREATE_BRACKETS and CREATE_GAMES are held by Admin only - event, bracket and game-lobby creation are gated to operators while those flows harden. Page creation is open to the Early Adopter and Open Beta tiers.
What each entitlement grants
Participation (every registered Member)
COLLECT_EDITIONS- Collect, burn, and transfer page/edition NFTsRSVP_EVENTS- Reserve tickets to eventsSUBMIT_BRACKETS- Submit bracket entries to tournaments
Asset authoring (Artist, Admin)
CREATE_ASSETS- Create and submit stickers and style templates to the catalog
Product deployment
CREATE_PAGES- Deploy page contracts and publish writing content (Early Adopter, Open Beta, Admin)CREATE_EVENTS- Deploy event contracts and manage events (Admin only during the testnet beta)CREATE_BRACKETS- Deploy bracket tournament contracts (Admin only during the testnet beta)CREATE_GAMES- Deploy game lobby contracts (Admin only during the testnet beta)
Protocol operations (Admin only)
VIEW_ADMIN_PANEL- Access the admin panel UIMANAGE_ACCOUNTS- Suspend and unsuspend accountsMANAGE_LISTINGS- Unlist and relist content from the API indexMANAGE_ROLES- Manage user roles and entitlementsMANAGE_CONTRACTS- Deploy and manage generic smart contractsMANAGE_ACHIEVEMENTS- Create and manage achievementsMANAGE_CHALLENGES- Create and manage writing challengesMANAGE_TEMPLATES- Create and manage page templatesMANAGE_FUNDING_GROUPS- Manage funding groups and sponsorsMANAGE_TOURNAMENTS- Enter results, lock/unlock brackets, authorize prize claimsMANAGE_STICKERS- Create and manage template stickersMANAGE_PRODUCT_TYPES- Manage the product type catalog
Notes
- Holding any
CREATE_PAGES/CREATE_EVENTS/CREATE_BRACKETS/CREATE_GAMESgrant is what separates a creator (Open Beta, Early Adopter, Admin) from a collect-only Member. CREATE_ASSETS(authoring stickers and styles) is deliberately not a product-deployment entitlement - an Artist can publish assets without being able to deploy a product.- Invite minting is not a dedicated entitlement. The daily mint quota is derived from the owner's highest role tier: Member, Open Beta and Early Adopter are 0 and Admin is unlimited, so every tier but Admin receives invites by assignment and sends them rather than minting.
Three authorization axes
Rising Tide separates three orthogonal questions. Keep them distinct:
| Concern | System | Scope | Enforced by |
|---|---|---|---|
| What may this user do? | Entitlements (RBAC, this page) | Protocol-global | the protocol API, on every user-acting route |
| Where may they do it? | Per-app access | Per (user, app) | the protocol API, fail-closed |
| Is this feature turned on here? | Feature flags | Per-app deployment | your own app |
Entitlements are protocol-level permissions enforced by the API. Per-app access is a first-class, revocable grant per (user, app) - minted on invite claim or by an operator, enforced fail-closed on acquisition and participation routes, and surfaced as OPEN | UNLOCKED | LOCKED states in the app catalog. Feature flags are your own per-deployment configuration and the protocol knows nothing about them.
See RBAC for how to check entitlements in your app.