From 88f788467f8de2773109255c53a94b6af66f60ec Mon Sep 17 00:00:00 2001
From: Benjamin Rewis <benji.rewis@viam.com>
Date: Mon, 27 Jul 2026 12:30:31 -0400
Subject: [PATCH] api changes

---
 proto/viam/app/v1/robot.proto | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/proto/viam/app/v1/robot.proto b/proto/viam/app/v1/robot.proto
index 8c6eb2f9fa..a7cfba086d 100644
--- a/proto/viam/app/v1/robot.proto
+++ b/proto/viam/app/v1/robot.proto
@@ -188,6 +188,27 @@ message AuthConfig {
   repeated AuthHandlerConfig handlers = 1;
   repeated string tls_auth_entities = 2;
   optional ExternalAuthConfig external_auth_config = 3;
+  repeated Role roles = 4;
+}
+
+// A Role describes the permissions an authenticated user has on this
+// machine. A user with no associated Role is unrestricted.
+message Role {
+  // user is the ID of the user this role applies to: an API key ID or a
+  // FusionAuth UUID.
+  string user = 1;
+  repeated Permission permissions = 2;
+}
+
+// A Permission grants a user the ability to invoke a set of methods on
+// resources with a given name.
+message Permission {
+  // resource is the name of the resource this permission applies to.
+  string resource = 1;
+  // methods is a list of fully qualified gRPC methods the user may invoke
+  // on resources of this name, e.g.
+  // "/viam.component.camera.v1.CameraService/GetImages".
+  repeated string methods = 2;
 }
 
 message JWKSFile {