Roles
StartupOS has five roles. They are realm roles in the Keycloak realm startupos. Services read them from the verified access token.
| Role in the product | Realm role | Name used inside the services | What the role is for |
|---|---|---|---|
| Founder | founder | founder | Takes courses, books mentors, joins live classes, watches recordings, holds certificates. |
| Mentor | mentor | mentor | Runs mentoring sessions, logs notes, teaches and moderates course content. |
| Spoke Coordinator | coordinator | spoke_coordinator | Runs one spoke. Sees that spoke's founders, cohorts and at-risk register. |
| CM Office | cm_office | govt_viewer | Read-only, state-wide programme analytics. Belongs to no spoke. |
| Administrator | admin | hub_admin | Platform-wide. Manages tenants, users, courses, certificates and settings. |
The services accept both spellings and map them to one name. The mapping lives in RoleEnforcementFilter in libs/common-models.
Tenants
A spoke is a tenant. A token for a Spoke Coordinator must carry a tenant claim that matches the spoke being addressed. The Administrator and CM Office roles are platform-wide, so the tenant check does not apply to them.
Where roles are enforced
Role checks are declared with @RequiresRole on resource methods and enforced by RoleEnforcementFilter. Some endpoints check ownership or enrolment in service code instead. The Security model describes the layers.
Sources: infra/keycloak/import-startupos-realm.sh (realm roles), libs/common-models/src/main/java/com/rtih/startupos/common/security/RoleEnforcementFilter.java (aliases and tenant rule), .kiro/specs/startupos-platform/requirements.md (role descriptions).