No, you cannot create roles only for a specific tenant in Permit.io. Roles are part of the policy schema and exist at the environment level, not the tenant level (1) . In Permit.io, tenants are part of the facts (data) layer, which means you can assign users to tenants with specific roles, but you can't have different role definitions for different tenants . The same roles are available across all tenants within an environment (2) . If you need different role schemas for different tenants, you have two options: 1. Use separate Projects and Environments in Permit's hierarchy (1) 2. Utilize the role attributes API-based feature to filter role associations The way multi-tenant authorization works in Permit.io is that roles are assigned to users within the context of specific tenants (3) . For example, a user can be an "Admin" in one tenant and a "Manager" in another tenant, but the role definitions themselves (what permissions "Admin" and "Manager" have) remain consistent across all tenants (4) .

To learn more, see the sources I considered: [[1] Multi-Tenant Authorization](https://docs.permit.io/concepts/multi-tenant-authorization) [[2] Policy Basics](https://docs.permit.io/how-to/build-policies/policy-basics) [[3] Best Practices for Multi-Tenant Authorization](https://www.permit.io/blog/best-practices-for-multi-tenant-authorization) [[4] Sync your First User](https://docs.permit.io/overview/sync-your-first-user-with-sdk)

Thanks for the feedback, glad I was helpful.

You can use role attributes to effectively achieve tenant-specific role filtering (1) (2) . Here's how this works: Role Attributes for Tenant Association The List Roles API allows filtering roles based on role attributes using the

attr_

prefix (1) . This feature enables you to retrieve only the roles matching specific attribute values, which can be used to associate roles with specific tenants . Example Implementation You can filter roles by attributes (such as marking them for specific tenants) by sending a GET request with the following format :

curl '<https://api.permit.io/v2/schema/{project}/{environment}/roles?attr_color=red&attr_access_level=high>' \  
 -H 'authorization: Bearer API_SECRET_KEY'

The

attr_

prefix is used to identify query parameters as attribute filters . You can use multiple attributes to narrow down your search further . This is useful when you need to filter roles based on custom attributes that your organization has defined, such as access levels, department names, or any other specific characteristics . By using role attributes to mark which tenants a role belongs to, you can effectively create tenant-specific role visibility while maintaining the centralized role schema (2) . For more details, check the documentation on Filter Role Associations (1) which covers this API-based role attribute feature.

To learn more, see the sources I considered: [[1] Overview](https://docs.permit.io/api/examples/filter-role-associations) [[2] Building an RBAC Policy](https://docs.permit.io/how-to/build-policies/rbac/building-rbac-policy)