Multi-Tenant Permissions vs Claude Code ACL

Permission systems are boring — until they fail. In a multi-tenant restaurant platform, a misconfigured permission means the competitor sees your menu and pricing. In Claude Code, a poorly evaluated permission means the AI deletes your main branch without asking.

This article compares two production approaches: the multi-tenant RBAC of Cadences Platform (used by dozens of SaaS verticals) and the tri-state ACL system of Claude Code (which invented something most RBAC frameworks lack: the "ask" state).

At the end we propose a hybrid pattern: AI-Enhanced RBAC — classic RBAC with the three superpowers Claude Code discovered.

Cadences Platform runs multiple SaaS verticals (restaurants, travel, healthcare) on shared Cloudflare Workers + D1 infrastructure. Tenant isolation is absolute: every query carries WHERE tenant_id = ?.

// Cadences Permission Model
Tenant (restaurant/agency/clinic)
  └── Roles
      ├── owner     → full access + billing
      ├── admin     → settings + staff management
      ├── manager   → operations + analytics
      ├── staff     → daily operations only
      └── viewer    → read-only

Enforcement: Workers middleware
  request → extract tenant_id → extract role
         → check: role >= required_role?
         → allow / deny

Resources: menu_items, orders, settings,
           integrations, analytics, staff

It's a proven, simple model. Permissions resolve in a single comparison: does the user's role have access to this resource? Yes or no. No ambiguity, no intermediate states.

Claude Code invented something most RBAC frameworks lack: a third state. It's not allow. It's not deny. It's ask — ask the human whether this specific operation is okay.

// Claude Code Permission Sources (cascading)
Level 1: Platform rules    ← Anthropic defines
Level 2: Organization ACL  ← company defines
Level 3: Project ACL       ← .claude/settings.json
Level 4: User preferences   ← ~/.claude/settings.json

// Evaluation order (deny-first)
for source in [platform, org, project, user]:
  if source.denies(tool, args): → DENY
  if source.allows(tool, args): → ALLOW

if mode == "auto":    → consult yolo classifier
if mode == "plan":    → ASK always
if mode == "default": → ASK if destructive

The 3 States

The Yolo Classifier: AI as Judge

When the mode is auto and a tool is in "ask" state, Claude Code doesn't ask directly — it first consults the yolo classifier: an AI model that evaluates whether the specific operation is safe in the current context.

Traditional RBAC is binary. You can or you can't. But in the real world, there are operations that depend on context:

"Ask" is the state most RBAC systems are missing. Not everything is black or white — sometimes the right answer is "you can, but confirm with someone first."

Claude Code has 4 cascading permission sources. Each level can override the one before it with deny (can never re-allow a deny from a higher level). Cadences has a natural equivalent:

Claude Code's yolo classifier is a model that classifies operations by risk. Could Cadences use the same concept? Absolutely:

Combining the best of both worlds, we propose a 4-layer pattern for SaaS systems with AI tools:

// AI-Enhanced RBAC in Cadences Workers
async function evaluatePermission(request, env) {
  const { tenantId, role, action, resource, args } = request;

  // Layer 0: RBAC base
  const rbac = await getRBAC(env.DB, tenantId, role);
  if (rbac[resource] === 'deny') return DENY;
  if (rbac[resource] === 'allow') {

    // Layer 1: is this an ask operation?
    const askRules = await getAskRules(env.DB, tenantId);
    const matchedRule = askRules.find(r =>
      r.action === action && matchGlob(r.pattern, args)
    );

    if (!matchedRule) return ALLOW;

    // Layer 2: AI classifier
    const risk = await classifyRisk(env.AI, {
      action, resource, args,
      context: { tenantId, role, timestamp: Date.now() }
    });

    if (risk === 'LOW')    return ALLOW;
    if (risk === 'MEDIUM') return ASK(args.reviewer);
    if (risk === 'HIGH')   return DENY;
  }

  // Layer 3: circuit breaker
  if (await getConsecutiveDenials(env.DB, tenantId) >= 3) {
    return DENY_ALL_SESSION;
  }

  return ASK(role.owner);
}

RBAC isn't dead — it was missing three things: a third state (ask), cascading sources, and an AI model that understands the content of the operation, not just the type.