# Users and permissions

Configure roles and authorize resource access.

## Define resource roles

Configure roles through `/nb-admin/roles/`. Use canonical resource permissions:

| Permission | Allows |
|---|---|
| `view-events` | Read events |
| `create-events` | Create events |
| `edit-events` | Update events |
| `delete-events` | Delete individual events |
| `manage-events` | Resource management |

Add `view-nimblybar` for the editor navigation and `edit-inline-content` for inline editing. Media access has its own permissions. Grant only the capabilities a role needs.

## Authorize at boundaries

Validate dynamic route input, then check the required access before exposing protected data or accepting a protected action. Use the existing access library and router functions; custom API handlers call `api_access()` and scope the operation to the signed-in user where required.

A template hiding a button is not authorization for the backend operation.

## API users

External integrations authenticate as users with API access enabled. Give each integration its own restricted role. A read-only event integration needs `view-events`; publication filtering and user-specific scoping remain explicit concerns.

Collection deletion has a separate permission, `api_delete_resource_events`. Ordinary record-delete permission does not grant deletion of the entire resource. See [API authorization](/en/docs/reference/api/).