iii-worker-rbac

name	iii-worker-rbac
description	Configure worker RBAC, filtered discovery, FORBIDDEN errors, registration hooks, auth functions, and safe browser/public worker-manager listeners in iii. Use when configuring permissions, tenant isolation, exposed functions, browser-safe worker access, or denied invocation behavior.

Worker RBAC

RBAC belongs on iii-worker-manager listeners. Use it to expose a constrained function surface to a worker or browser client while keeping the private engine worker port internal.

Core Concepts

• Public or untrusted clients connect to an RBAC-enabled worker-manager listener, not the private worker port.
• auth_function_id receives request connection data and returns an AuthResult.
• Discovery is filtered: callers only see functions and trigger types they are allowed to use.
• forbidden_functions override allowed lists and exposure filters.
• Denied invocation returns FORBIDDEN.
• A missing function and a forbidden function are different: missing means the engine has no callable registration; forbidden means policy denied access.

AuthInput

Auth functions receive:

• headers
• query_params
• ip_address

Browsers cannot reliably send custom WebSocket headers, so browser auth usually comes from query params, cookies, or upstream session context.

AuthResult

Return:

• allowed_functions: string[]
• forbidden_functions: string[]
• allowed_trigger_types?: string[]
• allow_trigger_type_registration: boolean
• allow_function_registration?: boolean