Open the editor

Access matrix

Who can do what: components against roles, one permission per cell.

1 access matrix example

Platform access matrix

Who can do what across eight platform components and four roles.

A permissions audit as one grid: rows are components, columns are roles, and each cell's fill says how much access it grants. The single focal cell is the critical rule, consumers can only select from the aggregated catalog.

Open in the editor

What is an access matrix?

An access matrix, also called a permission matrix or access control matrix, is a grid with components or resources in rows and roles in columns. Each cell states what that role can do with that resource, such as read, write, admin or none. The concept comes from Butler Lampson's access control model.

Read across a row to see who can touch a resource, or down a column to see everything a role is allowed to do.

When to use an access matrix

  • Use it to define role-based access control for a data platform before configuring permissions.
  • Use it in audits and compliance reviews to prove least privilege.
  • If you need to show how users authenticate and requests flow, an architecture or sequence diagram is the better fit.

How to make a good access matrix

  1. Use roles, not named people, as columns.
  2. Put one permission level per cell from a short, defined set, such as none, read, write, admin.
  3. Color cells by level so broad access stands out.
  4. Review every admin or write cell for a reason; empty justification usually means excess access.