RBAC Permission Matrix | IDA — Identity for the AI Age

Used in: §13.2 Permission Matrix Audience: all admin personas IA ID: D19 (rendered as Markdown table per IA “table-as-diagram” guidance)

Legend: ✅ allowed · 🚫 denied · 👤 owner-only (caller’s own DID/credential) · — N/A

Capability	Endpoint(s)	Holder	Issuer	Verifier	Admin
Sign in (OTP / OAuth / DID-Auth)	`/auth/*`	✅	✅	✅	✅
List own DIDs	`GET /dids`	✅	✅	✅	✅
Create DID	`POST /dids`	✅	✅	✅	✅
Update / deactivate / rotate own DID	`PUT /dids/{did}`, `DELETE /dids/{did}`, `POST /dids/{did}/rotate-key`	👤	👤	👤	👤
Universal DID resolve (any DID)	`GET /dids/resolve/{did}`	✅ (public)	✅	✅	✅
Read schemas	`GET /credentials/schemas`	✅	✅	✅	✅
Create schema	`POST /credentials/schemas`	🚫	✅	🚫	✅
Issue credential	`POST /credentials/issue`	🚫	✅	🚫	✅
Revoke / batch-revoke	`POST /credentials/revoke`, `/batch-revoke`	🚫	✅	🚫	✅
Verify credential / presentation	`POST /credentials/verify`, `/presentations/verify`	✅ (public)	✅	✅	✅
Create presentation	`POST /presentations/create`	✅	✅	✅	✅
Add verification record	`POST /verifications`	🚫	🚫	✅	✅
Read verifications history / stats	`GET /verifications/*`	✅	✅	✅	✅
Manage trusted issuers	`POST/DELETE /verifier/trusted-issuers/*`	🚫	🚫	✅	✅
Generate ZK challenge / proof	`POST /zkp/challenge`, `/zkp/proofs`	✅	✅	✅	✅
Verify ZK proof	`POST /zkp/verify`	✅ (public)	✅	✅	✅
Register / update / decommission agent	`POST /agents`, `PUT/DELETE /agents/{did}`	👤	👤	👤	✅
Read agent audit log / delegations	`GET /agents/{did}/audit-log`, `/delegations`	✅	✅	✅	✅
DIDComm send / receive (in-platform)	`POST /didcomm/send`, `/didcomm/receive`	✅	✅	✅	✅
Dashboard stats / events / activity	`GET /dashboard/*`	✅	✅	✅	✅
Issuer analytics	`GET /issuers/{did}/analytics`	✅	✅	✅	✅
Health / readiness	`GET /health`, `/ready`	✅ (public)	✅	✅	✅

Matrix verified against packages/api/internal/router/router.go lines 42–186 (middleware.RequireRoles("issuer" | "verifier")). Admin is treated as a superset role at the middleware layer.