7.1. Permissions

Hyperledger Iroha uses a role-based access control system to limit actions of its users. This system greatly helps to implement use cases involving user groups having different access levels — ranging from the weak users, who can’t even receive asset transfer to the super-users. The beauty of our permission system is that you don’t have to have a super-user in your Iroha setup or use all the possible permissions: you can create segregated and lightweight roles.

Maintenance of the system involves setting up roles and permissions, that are included in the roles. This might be done at the initial step of system deployment — in genesis block, or later when Iroha network is up and running, roles can be changed (if there is a role that can do that :)

This section will help you to understand permissions and give you an idea of how to create roles including certain permissions. Each permission is provided with an example written in Python that demonstrates the way of transaction or query creation, which require specific permission. Every example uses commons.py module, which listing is available at Supplementary Sources section.

7.2. List of Permissions

Permission Name Category Type
can_create_account Account Command
can_set_detail Account Command
can_set_my_account_detail grantable Account Command
can_create_asset Asset Command
can_receive Asset Command
can_transfer Asset Command
can_transfer_my_assets grantable Asset Command
can_add_asset_qty Asset Quantity Command
can_subtract_asset_qty Asset Quantity Command
can_add_domain_asset_qty Asset Quantity Command
can_subtract_domain_asset_qty Asset Quantity Command
can_create_domain Domain Command
can_grant_can_add_my_signatory Grant Command
can_grant_can_remove_my_signatory Grant Command
can_grant_can_set_my_account_detail Grant Command
can_grant_can_set_my_quorum Grant Command
can_grant_can_transfer_my_assets Grant Command
can_add_peer Peer Command
can_append_role Role Command
can_create_role Role Command
can_detach_role Role Command
can_add_my_signatory grantable Signatory Command
can_add_signatory Signatory Command
can_remove_my_signatory grantable Signatory Command
can_remove_signatory Signatory Command
can_set_my_quorum grantable Signatory Command
can_set_quorum Signatory Command
can_get_all_acc_detail Account Query
can_get_all_accounts Account Query
can_get_domain_acc_detail Account Query
can_get_domain_accounts Account Query
can_get_my_acc_detail Account Query
can_get_my_account Account Query
can_get_all_acc_ast Account Asset Query
can_get_domain_acc_ast Account Asset Query
can_get_my_acc_ast Account Asset Query
can_get_all_acc_ast_txs Account Asset Transaction Query
can_get_domain_acc_ast_txs Account Asset Transaction Query
can_get_my_acc_ast_txs Account Asset Transaction Query
can_get_all_acc_txs Account Transaction Query
can_get_domain_acc_txs Account Transaction Query
can_get_my_acc_txs Account Transaction Query
can_read_assets Asset Query
can_get_blocks Block Stream Query
can_get_roles Role Query
can_get_all_signatories Signatory Query
can_get_domain_signatories Signatory Query
can_get_my_signatories Signatory Query
can_get_all_txs Transaction Query
can_get_my_txs Transaction Query

7.2.3. Supplementary Sources