> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.adid.dev/llms.txt.
> For full documentation content, see https://docs.adid.dev/llms-full.txt.

# RBAC Permission Matrix

**Used in:** §13.2 Permission Matrix
**Audience:** all admin personas
**IA ID:** D19 (rendered as Markdown table per IA "table-as-diagram" guidance)

> Legend: ✅ allowed · 🚫 denied · 👤 owner-only (caller's own DID/credential) · — N/A

| Capability                             | Endpoint(s)                                                            |   Holder   | Issuer | Verifier | Admin |
| -------------------------------------- | ---------------------------------------------------------------------- | :--------: | :----: | :------: | :---: |
| Sign in (OTP / OAuth / DID-Auth)       | `/auth/*`                                                              |      ✅     |    ✅   |     ✅    |   ✅   |
| List own DIDs                          | `GET /dids`                                                            |      ✅     |    ✅   |     ✅    |   ✅   |
| Create DID                             | `POST /dids`                                                           |      ✅     |    ✅   |     ✅    |   ✅   |
| Update / deactivate / rotate own DID   | `PUT /dids/{did}`, `DELETE /dids/{did}`, `POST /dids/{did}/rotate-key` |     👤     |   👤   |    👤    |   👤  |
| Universal DID resolve (any DID)        | `GET /dids/resolve/{did}`                                              | ✅ (public) |    ✅   |     ✅    |   ✅   |
| Read schemas                           | `GET /credentials/schemas`                                             |      ✅     |    ✅   |     ✅    |   ✅   |
| Create schema                          | `POST /credentials/schemas`                                            |     🚫     |    ✅   |    🚫    |   ✅   |
| Issue credential                       | `POST /credentials/issue`                                              |     🚫     |    ✅   |    🚫    |   ✅   |
| Revoke / batch-revoke                  | `POST /credentials/revoke`, `/batch-revoke`                            |     🚫     |    ✅   |    🚫    |   ✅   |
| Verify credential / presentation       | `POST /credentials/verify`, `/presentations/verify`                    | ✅ (public) |    ✅   |     ✅    |   ✅   |
| Create presentation                    | `POST /presentations/create`                                           |      ✅     |    ✅   |     ✅    |   ✅   |
| Add verification record                | `POST /verifications`                                                  |     🚫     |   🚫   |     ✅    |   ✅   |
| Read verifications history / stats     | `GET /verifications/*`                                                 |      ✅     |    ✅   |     ✅    |   ✅   |
| Manage trusted issuers                 | `POST/DELETE /verifier/trusted-issuers/*`                              |     🚫     |   🚫   |     ✅    |   ✅   |
| Generate ZK challenge / proof          | `POST /zkp/challenge`, `/zkp/proofs`                                   |      ✅     |    ✅   |     ✅    |   ✅   |
| Verify ZK proof                        | `POST /zkp/verify`                                                     | ✅ (public) |    ✅   |     ✅    |   ✅   |
| Register / update / decommission agent | `POST /agents`, `PUT/DELETE /agents/{did}`                             |     👤     |   👤   |    👤    |   ✅   |
| Read agent audit log / delegations     | `GET /agents/{did}/audit-log`, `/delegations`                          |      ✅     |    ✅   |     ✅    |   ✅   |
| DIDComm send / receive (in-platform)   | `POST /didcomm/send`, `/didcomm/receive`                               |      ✅     |    ✅   |     ✅    |   ✅   |
| Dashboard stats / events / activity    | `GET /dashboard/*`                                                     |      ✅     |    ✅   |     ✅    |   ✅   |
| Issuer analytics                       | `GET /issuers/{did}/analytics`                                         |      ✅     |    ✅   |     ✅    |   ✅   |
| Health / readiness                     | `GET /health`, `/ready`                                                | ✅ (public) |    ✅   |     ✅    |   ✅   |

Matrix verified against `packages/api/internal/router/router.go` lines 42–186 (`middleware.RequireRoles("issuer" | "verifier")`). Admin is treated as a superset role at the middleware layer.

***