> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goalgen.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & access (RBAC)

> How GoalGen uses Clerk public metadata for roles, Genners, affiliates, and Creator Studio access

## What RBAC means here

GoalGen uses **Clerk** with **public metadata** (not Organizations) for a lightweight role system. The in-app **RBAC** screen (`/creator-studio/admin/roles`) lets authorized admins **search users** and update **app roles** and **Creator Studio roles** stored on each user.

<Info>
  **RBAC** in the UI is **platform administration**: who can administer users and access. It is separate from **content** work (templates, review queue) described in [Content library](/creator-studio/content-library).
</Info>

## Two metadata fields

| Field                       | Purpose                                                                                       |
| --------------------------- | --------------------------------------------------------------------------------------------- |
| `publicMetadata.role`       | **App-wide** role: member, affiliate, **Genners** (stored as `charter`), admin, super\_admin. |
| `publicMetadata.studioRole` | **Creator Studio program**: creator, founder, admin, super\_admin, or unset.                  |

You can combine them—for example **Genners** plus **creator** if someone is both an early backer and an approved creator.

### Display name: Genners

**Genners** is the product name for the **`charter`** role: early supporters, beta participants, and equity-aligned backers. The **Clerk key remains `charter`** so existing integrations stay stable.

### Other app roles

* **Affiliate** — referral and marketing partners.
* **Admin** / **Super admin** — staff; super admins can assign the `super_admin` app role to others.

Studio roles **creator** and **founder** control **Creator Studio** access (along with admin studio roles). See [Creator Studio overview](/creator-studio/overview) for navigation.

## Session token (JWT)

For server-side checks without an extra round trip, the Clerk **session token** should include:

```json theme={null}
{
  "metadata": "{{user.public_metadata}}"
}
```

Configure this under **Clerk Dashboard → Sessions → Customize session token**. Your app merges JWT `metadata` with `currentUser().publicMetadata` when resolving roles.

## Sidebar entry

In the main app sidebar:

* **Creator Studio** section → **Creator-S** opens Creator Studio (for eligible users).
* **Admin** section → **RBAC** opens the roles admin UI (admin-only).

## Security notes

<Note>
  **Public metadata** is readable in the client; only the **server** or Clerk Dashboard should **write** roles. The RBAC UI uses server actions with an admin check.
</Note>

<Warning>
  Treat **super\_admin** as highly sensitive. Only super admins should assign that role.
</Warning>

## FAQ

<AccordionGroup>
  <Accordion icon="user-shield" title="Why not Clerk Organizations?">
    GoalGen’s RBAC guide uses metadata-based roles so teams without orgs still get a clear permission model. You can migrate to Organizations later if needed.
  </Accordion>

  <Accordion icon="paintbrush" title="Where is RBAC documented for developers?">
    The repo includes `apps/app/docs/clerk-rbac-setup.md` with Clerk dashboard steps and field reference. This page is the user-facing summary.
  </Accordion>

  <Accordion icon="circle-question" title="I don’t see RBAC in the sidebar">
    You need an **admin** (`role` or `studioRole` of admin or super\_admin). Ask a super admin to update your metadata in Clerk or via the RBAC UI.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Creator Studio overview" icon="paintbrush" href="/creator-studio/overview">
    Product vs content vs platform navigation.
  </Card>

  <Card title="Content library" icon="books" href="/creator-studio/content-library">
    Templates, review, creators, settings.
  </Card>
</CardGroup>