documenso-enterprise-rbac

name	documenso-enterprise-rbac
description	Configure Documenso enterprise role-based access control and team management. Use when implementing team permissions, configuring organizational roles, or setting up enterprise access controls. Trigger with phrases like "documenso RBAC", "documenso teams", "documenso permissions", "documenso enterprise", "documenso roles".
allowed-tools	Read, Write, Edit
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
compatible-with	claude-code, codex, openclaw
tags	["saas","documenso","rbac"]

Documenso Enterprise RBAC

Overview

Configure team-based access control and enterprise features in Documenso. The Team plan enables multi-user collaboration with shared documents. Enterprise adds SSO (OIDC), audit logging, and organization-level management.

Prerequisites

• Documenso Team or Enterprise plan
• Understanding of RBAC concepts
• For SSO: OIDC-compatible identity provider (Okta, Azure AD, Google Workspace, Auth0)

Documenso Team Model

Organization
├── Team A
│   ├── Owner (full control)
│   ├── Admin (manage members, settings)
│   └── Member (create, view, sign team documents)
├── Team B
│   └── ...
└── Personal Accounts (separate from teams)

Key concepts:

• Teams are separate from personal accounts -- team documents are owned by the team
• Team API keys access all team documents; personal keys only access personal documents
• Each team member can have Owner, Admin, or Member role
• Unlimited teams and users on Team/Enterprise plans (early adopter pricing)

Instructions

Step 1: Team API Key Scoping

import { Documenso } from "@documenso/sdk-typescript";

// Personal key: only YOUR documents
const personalClient = new Documenso({
  apiKey: process.env.DOCUMENSO_PERSONAL_KEY!,
});

// Team key: all documents in the team
const teamClient = new Documenso({
  apiKey: process.env.DOCUMENSO_TEAM_KEY!,
});

// Common mistake: using personal key for team operations
// Results in 403 Forbidden on team resources

Step 2: Application-Level RBAC

Documenso handles team membership internally. For finer-grained control in your app, implement an authorization layer:

// src/auth/documenso-rbac.ts
  =  |  |  | ;

  {
  : ;
  : ;
  : ;
}

 : <, []> = {
  : [],
  : [, , ],
  : [, , , , ],
  : [, , , , , , ],
};

 ():  {
   [member.]?.(permission) ?? ;
}


 () {
    {
     member = req.; 
     (!(member, permission)) {
       res.().({
        : ,
        : permission,
        : member.,
      });
    }
    ();
  };
}


app.(,
  (),
   (req, res) => {
     teamClient..((req..));
    res.({ :  });
  }
);