juicebox-enterprise-rbac

# Juicebox Enterprise RBAC ## Overview Juicebox provides AI-powered people search and analysis for recruiting and sales teams. Enterprise RBAC controls who can search candidate databases, enrich profiles with contact info, trigger outreach sequences, and export data. Workspace admins manage team seats and API usage limits. Analysts run searches but may be restricted from exporting PII. Viewers can review saved searches without accessing raw contact data. SOC 2 compliance requires audit logging on all data enrichment and export actions. ## Role Hierarchy | Role | Permissions | Scope | |------|------------|-------| | Workspace Admin | Manage seats, billing, API keys, configure integrations | Entire workspace | | Recruiter | Search, enrich, access contact info, run outreach campaigns | All datasets | | Analyst | Search and enrich profiles, view analytics dashboards | Assigned datasets | | Sourcer | Search and enrich only, no contact reveal or outreach | Assigned datasets | | Viewer | View saved searches and reports, no data access or export | Read-only | ## Permission Check ```typescript async function checkJuiceboxAccess(userId: string, action: string, datasetId: string): Promise<boolean> { const response = await fetch(`${JUICEBOX_API}/v1/workspaces/${WORKSPACE_ID}/permissions`, { headers: { Authorization: `Bearer ${JUICEBOX_API_KEY}`, 'Content-Type': 'application/json' }, }); const perms = await response.json(); const user = perms.members.find((m: any) => m.i...