App Permissions Matrix Builder
Map roles to resource permissions in an editable CRUD matrix. Export a clear access specification as Markdown or JSON, free in your browser.
Access specification
Access permissions
| Role | Resource | Create | Read | Update | Delete | | --- | --- | --- | --- | --- | --- | | Guest | Projects | Deny | Deny | Deny | Deny | | Guest | Bookings | Deny | Deny | Deny | Deny | | Member | Projects | Deny | Allow | Deny | Deny | | Member | Bookings | Deny | Deny | Deny | Deny | | Admin | Projects | Allow | Allow | Allow | Allow | | Admin | Bookings | Deny | Deny | Deny | Deny |
Ownership & scope
Members can read only their own projects. Admin actions require an administrator role verified on the server.
Implementation
Deny access unless explicitly allowed. Enforce permissions on the server and test cross-user access. This matrix is a specification, not an authorization mechanism.
Export text stays in English; your input is kept as entered.
No signup. No AI credits. This tool assembles your output in your browser.
From an idea to something useful.
- 01
Add the roles and resources in your app.
- 02
Toggle create, read, update, and delete permissions.
- 03
Export the matrix and define ownership constraints.
A little context.
A role matrix makes access decisions reviewable before they turn into scattered conditionals. This tool records resource-level permissions and your ownership notes. It does not enforce authorization, generate database policies, or prove that an application is secure.
Good questions.
Does checking a box secure my app?
No. The matrix is a specification. Implement and test permissions on the server and database as appropriate.
How do I handle ownership?
Use the ownership constraints field to distinguish reading any record from reading only a user’s own records. A CRUD checkbox alone does not express row-level scope.