linear-enterprise-rbac

name	linear-enterprise-rbac
description	Implement enterprise role-based access control with Linear. Use when setting up team permissions, OAuth scopes, SAML SSO, SCIM provisioning, or audit logging. Trigger: "linear RBAC", "linear permissions", "linear SSO", "linear enterprise access", "linear role management", "linear SCIM".
allowed-tools	Read, Write, Edit, Grep
version	1.12.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","linear","rbac"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Linear Enterprise RBAC

Overview

Implement role-based access control for Linear integrations. Linear provides built-in organization roles (Owner, Admin, Member, Guest), team-level access control, and fine-grained OAuth scopes. Enterprise plans add SAML 2.0 SSO and SCIM user provisioning.

Prerequisites

• Linear Business or Enterprise plan (for SSO/SCIM)
• Organization admin access
• SSO provider (Okta, Azure AD, Google Workspace) for SAML
• Understanding of OAuth 2.0 scopes

Instructions

Step 1: Understand Linear's Built-In Roles

Role	Capabilities
Owner	Full workspace control, billing, delete workspace
Admin	Manage members, teams, integrations, workspace settings
Member	Create/edit issues, access team-visible data
Guest	Read-only access to invited teams only

These roles are fixed in Linear. Your application can layer additional permissions on top.

Step 2: Map Application Roles to OAuth Scopes

// src/auth/permissions.ts

// Available Linear OAuth scopes:
// read, write, issues:create, admin
// initiative:read, initiative:write
// customer:read, customer:write

const ROLE_SCOPES: Record<string, string[]> = {
  admin: ["read", "write", "issues:create", "admin"],
  manager: ["read", "write", "issues:create"],
  developer: ["read", "write", "issues:create"],
  viewer: [],
};

 : <,  |  | > = {
  : ,
  : ,
  : ,
  : ,
};