Roles & permissions for your users
How app roles drive what each person sees — and how to read that in code.
On this page
Roles live on your app, not in Vibe #
The roles your users belong to are defined on your Tadabase app (on the Users table). They drive row-level security — which records and which fields each role can see and change — and those exact same rules apply in the builder, over the API, and in your Vibe app. There is no separate Vibe permissions system.
tada.user().roles gives you the signed-in user's roles for showing badges or branching UI. A user can hold more than one role.
const me = tada.user();
// me.roles → [{ name: 'Manager' }, { name: 'Billing' }]Drive your UI off real permissions #
Rather than hardcoding role names ("if role === admin"), ask the server what this user can actually do. tada.me.permissions() returns, for every RLS-enabled table, the resolved answer: which operations they can perform, which records they reach, and which fields are readable / writable / masked / hidden.
- Show or hide a nav item based on whether the table is accessible.
- Enable New / Edit / Delete buttons from the table's operations.
- Render form fields from the writable list.