Boundaries that mean something
Projects isolate resources, global roles and project permissions decide who can touch them.
- Projects isolate everything
- Global roles plus project permissions
- Least privilege by default
The project is the boundary
Databases, applications, functions, storage, channels and keys all belong to a project. Cross-project access is not a setting you can accidentally leave on.
Two levels of access
A global role describes what kind of account this is. Project permissions describe what it may do inside a particular project. Both are checked.
New accounts are not superusers
A new managed account receives Admin and ownership of its first project, never global Master User privileges. Escalation is deliberate.
Permissions map to actions
app.read, database.read, sql.execute.write, rls.read and so on. The permission names match the operations, so a role is readable without a lookup table.
Separate environments with projects
Staging and production as two projects gives you separate credentials, separate keys and separate audit trails. It is the cheapest safety measure available.
Build the whole backend in one project
One plan, one dashboard, one command line interface. PostgreSQL, applications, functions, storage and realtime.