Every permission is one position on one ladder.

The capability ladder

Every permission in Kryex resolves to one of four levels, and there is no way to grant something outside this order.

The grant formula

A grant is the atomic unit of policy — five parts, and an optional approve-first modifier that turns an otherwise-allowed action into one that waits for a human sign-off before it executes.

How ties resolve

• Default deny — no grant on file means no access, full stop.
• Explicit deny beats everything — a grant set to none overrides any broader grant from a group.
• Most specific resource wins — a grant on one exact tool beats a grant on the whole connection.
• One active grant per user per connection — a new grant soft-revokes the prior one, so history stays queryable.

The org chart is real, not decorative

Every deployment has an organization as its tenant root, and inside it a hierarchy of scopes — organization → department → team → project — that mirrors the company's real structure. The Admin panel renders it as an actual interactive org chart: pan, zoom, collapse any team's subtree, click anyone to see their role, their team, and exactly which models and systems they can touch. Groups sit alongside individuals as first-class grantable principals, the same mechanism identity federation will plug straight into (see below).

Roles are permission bundles

Five built-in roles ship today, each a bundle of permissions stored as data, not hardcoded logic.

Delegation — bounded admin authority

A full organization admin shouldn't be the only person who can grant access — but letting every manager grant unlimited access anywhere is its own risk. An administrator can hand a manager a bounded slice of admin authority: grant access, but only inside that manager's own team, and never above a defined capability ceiling. Delegations can be re-delegable one level further and can expire automatically. Every grant made under a delegation carries a reference back to it — the audit trail always shows not just what was granted, but under whose delegated authority.

Approvals — human-in-the-loop, not a dead end

When a grant carries the approve-first flag, an otherwise-permitted action doesn't execute immediately — it's held, a notification lands in the administrator's approvals inbox with full context (who, what system, what exact action), and the agent is told to wait or move on to something else. On approval, Kryex executes the held action right then and stores the result, so the agent's next retry picks up the real, already-computed result instead of re-triggering another pending approval. A denial is just as final — the retry is told plainly the call was denied, and it stops asking. The same mechanism covers access requests: a developer asking for standing access they don't currently have, with an optional business justification captured for the approver.

Identity federation

Groups already sit alongside individuals as first-class, grantable principals today — built from day one to become live mirrors of your real identity-provider groups the moment federation lands.