Roles and permissions

Four independent layers decide who may do what in this wiki. This section tells you which role you currently hold, what it allows, what it does not allow — and how to get more without having to go looking for somebody.

Getting started

Why am I not allowed to do this? — the two questions a closed page raises, in the order in which they can be answered.

Recognise your current role → Look up the required role → Request access

Common tasks

Your question	Answer
Which role do I currently hold in this area?	Recognising your current role
What does a given role allow, and what not?	Role matrix
How do I request access?	How to: request access
I am signed in and still turned away.	Signed in and still turned away
An area asks for a second factor I do not have.	The area asks for a second factor
I have lost my authenticator.	Requesting a two-factor reset
Where do I see my open requests?	Tracking a request
I maintain a project — how do I work through incoming requests?	Settling requests

The four layers

Each layer answers a question of its own. They are additive: a layer can only narrow what the one below it has already allowed. No layer can overrule another.

<html>

<div style="min-width:520px">
  <div style="border-bottom:1px solid #e3e6ec;padding:10px 12px;display:grid;grid-template-columns:26px 150px 1fr;gap:12px;align-items:baseline">
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#8a94a6">1</div>
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#3b4252">DokuWiki ACL</div>
    <div style="font:11px/1.5 system-ui,sans-serif;color:#5b6472">May this account see or change this page at all? A 0&ndash;255 ladder, accounts and groups.</div>
  </div>
  <div style="border-bottom:1px solid #e3e6ec;padding:10px 12px;display:grid;grid-template-columns:26px 150px 1fr;gap:12px;align-items:baseline">
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#8a94a6">2</div>
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#3b4252">Session assurance</div>
    <div style="font:11px/1.5 system-ui,sans-serif;color:#5b6472">Has <em>this session</em> proved enough? Not a permission but a property of the sign-in.</div>
  </div>
  <div style="border-bottom:1px solid #e3e6ec;padding:10px 12px;display:grid;grid-template-columns:26px 150px 1fr;gap:12px;align-items:baseline">
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#8a94a6">3</div>
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#3b4252">Project role</div>
    <div style="font:11px/1.5 system-ui,sans-serif;color:#5b6472">What rank does this account hold <em>in this project</em>? Reader, contributor, maintainer.</div>
  </div>
  <div style="padding:10px 12px;display:grid;grid-template-columns:26px 150px 1fr;gap:12px;align-items:baseline">
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#8a94a6">4</div>
    <div style="font:600 12px/1.4 system-ui,sans-serif;color:#3b4252">Component tiers</div>
    <div style="font:11px/1.5 system-ui,sans-serif;color:#5b6472">Ladders of individual components &mdash; repository mount tiers, the Data Studio capability matrix.</div>
  </div>
</div>

</html>

Layer	Answers	Maintained in	Look up
1 DokuWiki ACL	read, edit, create, upload, delete	`?do=admin` → Access control	Layer 1
2 Session assurance	is a password enough, or is a second factor needed?	`wkidentity` policy	Layer 2
3 Project role	rank within one project	groups `@dwdo_<project>_*`	Layer 3
4 Component tiers	what one component additionally requires	differs per component	Layer 4

A higher layer never widens. Somebody without the ACL for a page does not get in as a maintainer either: layer 3 is only asked once layer 1 has already agreed. The reverse is the common case — layer 1 allows it and layer 2 additionally asks for a second factor.

What this section guarantees

Every refusal names two rungs. What was required and what your account holds, side by side. The gap between them is the explanation.
Every refusal names an alternative where one exists: another account, a read-only route, the way round via the project page.
No refusal ends in “contact your administrator”. Where a request is technically possible, the control sits on the screen that turned you away.
A request never grants anything. It records that somebody asked. A person decides, on the screen that owns the permission.
The people who run the area are asked first. A request about a project goes to its maintainers, not to the global administration. That remains the fallback, not the first route.

Administration

Settling requests — the inbox, the states of a request, and who may answer one.
Who maintains what — which screen changes which layer.
Known gaps — where the model today does less than this page promises.

Troubleshooting

For developers

The contract for components — how your own component hangs its refusal on the same infrastructure.
wkrequest — the component that takes requests and runs the inbox.
wkidentity — sign-in, second factor and session assurance.
wkdocore — projects, project roles and the group overlay.