Scope Overrides

Overview

Scope overrides allow you to modify inherited permissions at specific points in your scope hierarchy. This enables fine-grained control without restructuring your entire role and permission model.

Types of Overrides

Bedrock supports three types of overrides:

Override Type	What it Controls	Use Case
Role Override	`active` / `inactive` an entire role at a scope	Deactivate “Admin” in production
Permission Override	`active` / `inactive` a specific permission at a scope	Deactivate “delete” in compliance areas
Role-Permission Override	`grant` / `revoke` a permission for a specific role at a scope	Revoke “write” for “Editor” in archived projects

How Overrides Work

Overrides are applied per scope during grant resolution:

Resolve the subject's grants at the request scope (per its permissionMode)
Apply THAT scope's overrides (role active/inactive, permission active/inactive,
   role-permission grant/revoke)
Return the effective grants

Overrides are per-scope, not a top-down cascade: an override set at a parent scope does not automatically apply to children evaluated under the default override mode. A role-permission grant can add a grant for a role the subject already holds; revoke/ inactive remove grants. See Scope Overrides for the full model.

Role Overrides

Disable or enable an entire role at a specific scope.

Example: Disable Admin Role in Production

# Admin role is defined at org level
curl -X POST 'https://api.example.com/roles' \
  -d '{
    "name": "Admin",
    "description": "Full administrative access",
    "scopeId": "scope_org"
  }'

# Disable Admin role in production scope
curl -X POST 'https://api.example.com/scope-overrides/roles' \
  -H 'Content-Type: application/json' \
  -d '{
    "childScopeId": "scope_production",
    "roleId": "role_admin",
    "state": "inactive"
  }'

Now users with the Admin role won’t have admin access in the production scope.

Updating Role Overrides

# Re-activate the role
curl -X PUT 'https://api.example.com/scope-overrides/roles/override_123' \
  -d '{"state": "active"}'

Permission Overrides

Disable or enable a specific permission at a scope.

Example: Disable Delete Permission in Compliance Scope

# Delete permission exists at org level
curl -X POST 'https://api.example.com/permissions' \
  -d '{"scopeId": "scope_org", "action": "delete", "resourceType": "record", "resourcePattern": "*", "key": "record:delete:*"}'

# Disable delete in compliance scope
curl -X POST 'https://api.example.com/scope-overrides/permissions' \
  -d '{
    "childScopeId": "scope_compliance",
    "permissionId": "perm_delete_records",
    "state": "inactive"
  }'

Example: Disable Code Execution for All Agents

# Disable execute permission in production
curl -X POST 'https://api.example.com/scope-overrides/permissions' \
  -d '{
    "childScopeId": "scope_production",
    "permissionId": "perm_execute_code",
    "state": "inactive"
  }'

Role-Permission Overrides

The most granular override: disable a specific permission for a specific role at a specific scope.

Example: Editors Can’t Delete in Archived Projects

# Editor role has delete permission at org level
curl -X POST 'https://api.example.com/role-permissions' \
  -d '{"roleId": "role_editor", "permissionId": "perm_delete"}'

# But not in archived projects
curl -X POST 'https://api.example.com/scope-overrides/role-permissions' \
  -d '{
    "childScopeId": "scope_archived_projects",
    "roleId": "role_editor",
    "permissionId": "perm_delete",
    "state": "revoke"
  }'

Example: Agents Can Read But Not Write in Sensitive Areas

# Agent role has both read and write
curl -X POST 'https://api.example.com/role-permissions' \
  -d '{"roleId": "role_agent_writer", "permissionId": "perm_read"}'

curl -X POST 'https://api.example.com/role-permissions' \
  -d '{"roleId": "role_agent_writer", "permissionId": "perm_write"}'

# Disable write for this role in customer data scope
curl -X POST 'https://api.example.com/scope-overrides/role-permissions' \
  -d '{
    "childScopeId": "scope_customer_data",
    "roleId": "role_agent_writer",
    "permissionId": "perm_write",
    "state": "revoke"
  }'

Overrides Are Per-Scope

Overrides are applied at the scope where they are set—there is no cross-scope “most specific wins” precedence and no automatic top-down cascade. Under the default override permissionMode, only the request scope’s own overrides apply; under inherit/additive, each scope’s overrides apply to that scope’s grants as they compose. To restrict at multiple scopes, set the override at each. See Scope Overrides and Scope Types.

Viewing Overrides

Get All Overrides for a Scope

# Role overrides
curl -X GET 'https://api.example.com/scope-overrides/roles/scope_production'

# Permission overrides
curl -X GET 'https://api.example.com/scope-overrides/permissions/scope_production'

# Role-permission overrides
curl -X GET 'https://api.example.com/scope-overrides/role-permissions/scope_production'

Deleting Overrides

# Delete by ID
curl -X DELETE 'https://api.example.com/scope-overrides/roles/override_123'

# Delete by scope and role
curl -X DELETE 'https://api.example.com/scope-overrides/roles/scope_production/role_admin'

# Delete role-permission override by all IDs
curl -X DELETE 'https://api.example.com/scope-overrides/role-permissions/scope_production/role_editor/perm_delete'

Common Patterns

Pattern 1: Production Lockdown

Restrict dangerous operations in production:

# Disable multiple destructive permissions at once
curl -X POST 'https://api.example.com/scope-overrides/permissions/batch' \
  -H 'Content-Type: application/json' \
  -d '[
    {"childScopeId": "scope_prod", "permissionId": "perm_delete", "state": "inactive"},
    {"childScopeId": "scope_prod", "permissionId": "perm_execute", "state": "inactive"},
    {"childScopeId": "scope_prod", "permissionId": "perm_modify_infra", "state": "inactive"}
  ]'

Pattern 2: Agent Sandboxing

Restrict agent capabilities in sensitive areas:

# Batch restrict agent permissions in sensitive scopes
curl -X POST 'https://api.example.com/scope-overrides/role-permissions/batch' \
  -H 'Content-Type: application/json' \
  -d '[
    {"childScopeId": "scope_customer_data", "roleId": "role_agent", "permissionId": "perm_write", "state": "revoke"},
    {"childScopeId": "scope_pii", "roleId": "role_agent", "permissionId": "perm_read", "state": "revoke"}
  ]'

Pattern 3: Temporary Restrictions

Apply temporary restrictions during incidents:

# During incident: disable all writes
curl -X POST 'https://api.example.com/scope-overrides/permissions' \
  -d '{
    "childScopeId": "scope_affected_service",
    "permissionId": "perm_write",
    "state": "inactive"
  }'

# After incident: remove override
curl -X DELETE 'https://api.example.com/scope-overrides/permissions/scope_affected_service/perm_write'

Pattern 4: Compliance Zones

Create compliance zones with restricted access:

# Set up multiple compliance zones at once
curl -X POST 'https://api.example.com/scope-overrides/permissions/batch' \
  -H 'Content-Type: application/json' \
  -d '[
    {"childScopeId": "scope_soc2", "permissionId": "perm_export_data", "state": "inactive"},
    {"childScopeId": "scope_hipaa", "permissionId": "perm_share_external", "state": "inactive"},
    {"childScopeId": "scope_hipaa", "permissionId": "perm_export_data", "state": "inactive"}
  ]'

Best Practices

Use overrides sparingly

Too many overrides make the system hard to understand. Prefer restructuring roles when possible.

Document your overrides

Keep a record of why each override exists and when it should be reviewed.

Prefer permission overrides over role overrides

Permission overrides are more granular and less likely to have unintended effects.

Test override effects

Before applying overrides in production, test in a staging environment.

Audit override changes

Log all override creations, updates, and deletions for compliance.

Next Steps

User Governance

Apply overrides to user permissions

Agent Governance

Apply overrides to agent permissions

Getting Started

Core Concepts

Resources

Tags

Delegation

Use Cases

Modeling Guides

Scope Overrides

Overview

Types of Overrides

How Overrides Work

Role Overrides

Example: Disable Admin Role in Production

Updating Role Overrides

Permission Overrides

Example: Disable Delete Permission in Compliance Scope

Example: Disable Code Execution for All Agents

Role-Permission Overrides

Example: Editors Can’t Delete in Archived Projects

Example: Agents Can Read But Not Write in Sensitive Areas

Overrides Are Per-Scope

Viewing Overrides

Get All Overrides for a Scope

Deleting Overrides

Common Patterns

Pattern 1: Production Lockdown

Pattern 2: Agent Sandboxing

Pattern 3: Temporary Restrictions

Pattern 4: Compliance Zones

Best Practices

Next Steps

User Governance

Agent Governance

​Overview

​Types of Overrides

​How Overrides Work

​Role Overrides

​Example: Disable Admin Role in Production

​Updating Role Overrides

​Permission Overrides

​Example: Disable Delete Permission in Compliance Scope

​Example: Disable Code Execution for All Agents

​Role-Permission Overrides

​Example: Editors Can’t Delete in Archived Projects

​Example: Agents Can Read But Not Write in Sensitive Areas

​Overrides Are Per-Scope

​Viewing Overrides

​Get All Overrides for a Scope

​Deleting Overrides

​Common Patterns

​Pattern 1: Production Lockdown

​Pattern 2: Agent Sandboxing

​Pattern 3: Temporary Restrictions

​Pattern 4: Compliance Zones

​Best Practices

​Next Steps

User Governance

Agent Governance

Overview

Types of Overrides

How Overrides Work

Role Overrides

Example: Disable Admin Role in Production

Updating Role Overrides

Permission Overrides

Example: Disable Delete Permission in Compliance Scope

Example: Disable Code Execution for All Agents

Role-Permission Overrides

Example: Editors Can’t Delete in Archived Projects

Example: Agents Can Read But Not Write in Sensitive Areas

Overrides Are Per-Scope

Viewing Overrides

Get All Overrides for a Scope

Deleting Overrides

Common Patterns

Pattern 1: Production Lockdown

Pattern 2: Agent Sandboxing

Pattern 3: Temporary Restrictions

Pattern 4: Compliance Zones

Best Practices

Next Steps