linear-enterprise-rbac

# Linear Enterprise RBAC ## Overview Implement role-based access control for Linear integrations. Linear provides built-in organization roles (Owner, Admin, Member, Guest), team-level access control, and fine-grained OAuth scopes. Enterprise plans add SAML 2.0 SSO and SCIM user provisioning. ## Prerequisites - Linear Business or Enterprise plan (for SSO/SCIM) - Organization admin access - SSO provider (Okta, Azure AD, Google Workspace) for SAML - Understanding of OAuth 2.0 scopes ## Instructions ### Step 1: Understand Linear's Built-In Roles | Role | Capabilities | |------|-------------| | **Owner** | Full workspace control, billing, delete workspace | | **Admin** | Manage members, teams, integrations, workspace settings | | **Member** | Create/edit issues, access team-visible data | | **Guest** | Read-only access to invited teams only | These roles are fixed in Linear. Your application can layer additional permissions on top. ### Step 2: Map Application Roles to OAuth Scopes ```typescript // src/auth/permissions.ts // Available Linear OAuth scopes: // read, write, issues:create, admin // initiative:read, initiative:write // customer:read, customer:write const ROLE_SCOPES: Record<string, string[]> = { admin: ["read", "write", "issues:create", "admin"], manager: ["read", "write", "issues:create"], developer: ["read", "write", "issues:create"], viewer: ["read"], }; const TEAM_ACCESS: Record<string, "member" | "guest" | "none"> = { admin: "member", manager:...