Translation project permissions
A project is the permission root. Its locales, translations and experiments inherit access; they do not need separate sharing rules. Published Redis bundles, resolution and missing-key telemetry check the same project authority on each request. Publishing a bundle does not make it public.
| Operation | Required project access |
|---|---|
| Read projects, locales, published strings, bundles and reports | Reader |
| Submit missing-key telemetry | Reader |
| Upload drafts, create locales, create experiments | Editor |
| Approve translations, publish, roll back | Manager |
| Share with another person, group or service account | Manager |
An editor's content changes become drafts. They cannot set a translation's approval state or a project's active publication version directly through the generated database client. Approval and publication remain manager operations.
Share a project
snug access grant --target i18n-projects --id PROJECT \
--subject-kind user --subject-id TRANSLATOR --role editor
snug access grant --target i18n-projects --id PROJECT \
--subject-kind group --subject-id REVIEWERS --role manager
snug access revoke --target i18n-projects --id PROJECT \
--subject-kind user --subject-id TRANSLATOR --role editorHTTP clients use POST or DELETE /api/v1/access/i18n-projects/{id}/grants
with a body such as {"role":"reader","subject":{"kind":"user","id":"USER"}}.
Grants can expire. Removing one grant does not remove another valid access path.
Unshared projects return 404 to other users; visible projects return 403 for
operations their access does not permit. Platform roles in a JWT do not bypass this.
Personal and workspace projects
Creation requires creator access in the selected workspace. Personal projects
default to private. project create --workspace-id WORKSPACE --visibility workspace
uses the workspace's live reader, editor and manager relationships. Group removal
and revoked membership also revoke access to published copy.
Service accounts use workspace custody, with their identity retained as the creator. A create-only service may create a project without gaining ongoing read or write rights. Give it editor access to prepare drafts, or manager access if it must publish. Disabled credentials stop working. Project limits count all projects in the tenant, including private projects the caller cannot read.
SQL metadata and published Redis bundles are separate stores. Permission checks protect both, but publication is not a distributed transaction across them.