diff --git a/proto/viam/app/v1/robot.proto b/proto/viam/app/v1/robot.proto
index 8c6eb2f9f..61afc4c21 100644
--- a/proto/viam/app/v1/robot.proto
+++ b/proto/viam/app/v1/robot.proto
@@ -188,6 +188,38 @@ message AuthConfig {
   repeated AuthHandlerConfig handlers = 1;
   repeated string tls_auth_entities = 2;
   optional ExternalAuthConfig external_auth_config = 3;
+  repeated Role roles = 4;
+}
+
+// A Role describes the permissions a set of authenticated users
+// have on this machine.
+message Role {
+  // users are the Users this Role applies to. A User can only be
+  // listed in a single Role for a set of Roles.
+  repeated User users = 1;
+  repeated Permission permissions = 2;
+}
+
+// A User describes a single user that a Role applies to.
+message User {
+  // type is the type of user. Can be "api-key-id", "email", or "default".
+  string type = 1;
+  // id is the API Key ID if type is "api-key-id", the e-mail address if
+  // type is "email", and empty if type is "default".
+  string id = 2;
+}
+
+// A Permission grants a set of users the ability to invoke a set of
+// methods on a set of resources.
+message Permission {
+  // resources are the names of the resources this permission applies to,
+  // e.g. ["cam1", "cam2", "cam3"].
+  repeated string resources = 1;
+  // allowed_methods is a list of fully qualified gRPC methods the user
+  // may invoke on the listed resources, e.g.
+  // ["/viam.component.camera.v1.CameraService/GetImages",
+  // "/viam.component.camera.v1.CameraService/GetProperties"].
+  repeated string allowed_methods = 2;
 }
 
 message JWKSFile {