Roles and Privileges

Enforcement model

Every protected route requires a specific privilege, checked against the caller’s JWT with a 5-second timeout. If not authorized, the request is rejected with 403 FORBIDDEN.
CRUD routes require admin; workflow routes do not.
Bypass: SKIP_AUTH=true skips the check entirely (local/testing only).
JWT/authorization failures are normalized to PIM error codes; upstream User Service (EQ-USR-*) codes are mapped into PIM equivalents.

Full privilege list

Format: pim:<action>:<resource>.

Resource	Privileges
instance	`pim:create:instance`, `pim:view:instance`, `pim:update:instance`, `pim:delete:instance`
instance-attribute	`pim:view:instance-attribute`
attribute (and groups)	`pim:create:attribute`, `pim:view:attribute`, `pim:update:attribute`, `pim:delete:attribute`
catalog	`pim:create:catalog`, `pim:view:catalog`, `pim:update:catalog`, `pim:delete:catalog`
product (incl. composites)	`pim:create:product`, `pim:view:product`, `pim:update:product`, `pim:delete:product`
product-template	`pim:create:product-template`, `pim:view:product-template`, `pim:update:product-template`, `pim:delete:product-template`
category	`pim:create:category`, `pim:view:category`, `pim:update:category`, `pim:delete:category`
navigation	`pim:create:navigation`, `pim:view:navigation`, `pim:update:navigation`, `pim:delete:navigation`
asset	`pim:create:asset`, `pim:view:asset`, `pim:update:asset`, `pim:delete:asset`
sku	`pim:create:sku`, `pim:view:sku`, `pim:update:sku`, `pim:delete:sku`
price	`pim:create:price`, `pim:view:price`, `pim:update:price`, `pim:delete:price`
price-facet	`pim:create:price-facet`, `pim:view:price-facet`, `pim:update:price-facet`, `pim:delete:price-facet`
price-list	`pim:create:price-list`, `pim:view:price-list`, `pim:update:price-list`, `pim:delete:price-list`
price-rule	`pim:create:price-rule`, `pim:view:price-rule`, `pim:update:price-rule`, `pim:delete:price-rule`
synonym	`pim:manage:synonym`
redirect-url	`pim:manage:redirect-url`
workflow / versioning	`pim:create:`, `pim:view:`, `pim:approve:*`, `pim:view`, `pim:update`

Public (no privilege): all /v1/search/*, /v1/action/*, /v1/health, and (local-only) /v1/internal/*.