Get rid of previous permission providers

Signed-off-by: Émile Ré <nemile.re@gmail.com>

apps/console/src/__generated__/core/MainLayoutQuery.graphql.ts

@@ -1,161 +0,0 @@
-/**
- * @generated SignedSource<<f441167b6ed9402b92fcdf6dbaa77170>>
- * @lightSyntaxTransform
- * @nogrep
- */
-
-/* tslint:disable */
-/* eslint-disable */
-// @ts-nocheck
-
-import { ConcreteRequest } from 'relay-runtime';
-export type MainLayoutQuery$variables = {
-  organizationId: string;
-};
-export type MainLayoutQuery$data = {
-  readonly organization: {
-    readonly id?: string;
-    readonly logoUrl?: string | null | undefined;
-    readonly name?: string;
-  };
-  readonly viewer: {
-    readonly id: string;
-  };
-};
-export type MainLayoutQuery = {
-  response: MainLayoutQuery$data;
-  variables: MainLayoutQuery$variables;
-};
-
-const node: ConcreteRequest = (function(){
-var v0 = [
-  {
-    "defaultValue": null,
-    "kind": "LocalArgument",
-    "name": "organizationId"
-  }
-],
-v1 = {
-  "alias": null,
-  "args": null,
-  "kind": "ScalarField",
-  "name": "id",
-  "storageKey": null
-},
-v2 = {
-  "alias": null,
-  "args": null,
-  "concreteType": "Viewer",
-  "kind": "LinkedField",
-  "name": "viewer",
-  "plural": false,
-  "selections": [
-    (v1/*: any*/)
-  ],
-  "storageKey": null
-},
-v3 = [
-  {
-    "kind": "Variable",
-    "name": "id",
-    "variableName": "organizationId"
-  }
-],
-v4 = {
-  "alias": null,
-  "args": null,
-  "kind": "ScalarField",
-  "name": "name",
-  "storageKey": null
-},
-v5 = {
-  "alias": null,
-  "args": null,
-  "kind": "ScalarField",
-  "name": "logoUrl",
-  "storageKey": null
-};
-return {
-  "fragment": {
-    "argumentDefinitions": (v0/*: any*/),
-    "kind": "Fragment",
-    "metadata": null,
-    "name": "MainLayoutQuery",
-    "selections": [
-      (v2/*: any*/),
-      {
-        "alias": "organization",
-        "args": (v3/*: any*/),
-        "concreteType": null,
-        "kind": "LinkedField",
-        "name": "node",
-        "plural": false,
-        "selections": [
-          {
-            "kind": "InlineFragment",
-            "selections": [
-              (v1/*: any*/),
-              (v4/*: any*/),
-              (v5/*: any*/)
-            ],
-            "type": "Organization",
-            "abstractKey": null
-          }
-        ],
-        "storageKey": null
-      }
-    ],
-    "type": "Query",
-    "abstractKey": null
-  },
-  "kind": "Request",
-  "operation": {
-    "argumentDefinitions": (v0/*: any*/),
-    "kind": "Operation",
-    "name": "MainLayoutQuery",
-    "selections": [
-      (v2/*: any*/),
-      {
-        "alias": "organization",
-        "args": (v3/*: any*/),
-        "concreteType": null,
-        "kind": "LinkedField",
-        "name": "node",
-        "plural": false,
-        "selections": [
-          {
-            "alias": null,
-            "args": null,
-            "kind": "ScalarField",
-            "name": "__typename",
-            "storageKey": null
-          },
-          (v1/*: any*/),
-          {
-            "kind": "InlineFragment",
-            "selections": [
-              (v4/*: any*/),
-              (v5/*: any*/)
-            ],
-            "type": "Organization",
-            "abstractKey": null
-          }
-        ],
-        "storageKey": null
-      }
-    ]
-  },
-  "params": {
-    "cacheID": "2ec49ff40720bacec29e7b6b1bf1408b",
-    "id": null,
-    "metadata": {},
-    "name": "MainLayoutQuery",
-    "operationKind": "query",
-    "text": "query MainLayoutQuery(\n  $organizationId: ID!\n) {\n  viewer {\n    id\n  }\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      name\n      logoUrl\n    }\n    id\n  }\n}\n"
-  }
-};
-})();
-
-(node as any).hash = "d958a2acbd9d13698b9c2b350b05d5a0";
-
-export default node;

apps/console/src/__generated__/core/RightsRequestGraphListQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<22e08aea59fb3427d7770d89a44d6e9e>>
+ * @generated SignedSource<<5eff506b761b5790caf4b18a51cf2a88>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,6 +15,7 @@ export type RightsRequestGraphListQuery$variables = {
 };
 export type RightsRequestGraphListQuery$data = {
   readonly node: {
+    readonly canCreateRightsRequest?: boolean;
     readonly " $fragmentSpreads": FragmentRefs<"RightsRequestsPageFragment">;
   };
 };
@@ -39,20 +40,33 @@ v1 = [
   }
 ],
 v2 = {
+  "alias": "canCreateRightsRequest",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:rights-request:create"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:rights-request:create\")"
+},
+v3 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "__typename",
   "storageKey": null
 },
-v3 = {
+v4 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "id",
   "storageKey": null
 },
-v4 = [
+v5 = [
   {
     "kind": "Literal",
     "name": "first",
@@ -77,6 +91,7 @@ return {
           {
             "kind": "InlineFragment",
             "selections": [
+              (v2/*: any*/),
               {
                 "args": null,
                 "kind": "FragmentSpread",
@@ -107,14 +122,15 @@ return {
         "name": "node",
         "plural": false,
         "selections": [
-          (v2/*: any*/),
           (v3/*: any*/),
+          (v4/*: any*/),
           {
             "kind": "InlineFragment",
             "selections": [
+              (v2/*: any*/),
               {
                 "alias": null,
-                "args": (v4/*: any*/),
+                "args": (v5/*: any*/),
                 "concreteType": "RightsRequestConnection",
                 "kind": "LinkedField",
                 "name": "rightsRequests",
@@ -143,7 +159,7 @@ return {
                         "name": "node",
                         "plural": false,
                         "selections": [
-                          (v3/*: any*/),
+                          (v4/*: any*/),
                           {
                             "alias": null,
                             "args": null,
@@ -207,7 +223,33 @@ return {
                             "name": "updatedAt",
                             "storageKey": null
                           },
-                          (v2/*: any*/)
+                          {
+                            "alias": "canDelete",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:rights-request:delete"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:rights-request:delete\")"
+                          },
+                          {
+                            "alias": "canUpdate",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:rights-request:update"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:rights-request:update\")"
+                          },
+                          (v3/*: any*/)
                         ],
                         "storageKey": null
                       },
@@ -263,7 +305,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v4/*: any*/),
+                "args": (v5/*: any*/),
                 "filters": null,
                 "handle": "connection",
                 "key": "RightsRequestsPage_rightsRequests",
@@ -280,16 +322,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "77f124136a2da2eb84fb134e5d10396b",
+    "cacheID": "6bc485c10a9531beeb67aa6ff28a7ddc",
     "id": null,
     "metadata": {},
     "name": "RightsRequestGraphListQuery",
     "operationKind": "query",
-    "text": "query RightsRequestGraphListQuery(\n  $organizationId: ID!\n) {\n  node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      ...RightsRequestsPageFragment\n    }\n    id\n  }\n}\n\nfragment RightsRequestsPageFragment on Organization {\n  id\n  rightsRequests(first: 10) {\n    totalCount\n    edges {\n      node {\n        id\n        requestType\n        requestState\n        dataSubject\n        contact\n        details\n        deadline\n        actionTaken\n        createdAt\n        updatedAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n    }\n  }\n}\n"
+    "text": "query RightsRequestGraphListQuery(\n  $organizationId: ID!\n) {\n  node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      canCreateRightsRequest: permission(action: \"core:rights-request:create\")\n      ...RightsRequestsPageFragment\n    }\n    id\n  }\n}\n\nfragment RightsRequestsPageFragment on Organization {\n  id\n  rightsRequests(first: 10) {\n    totalCount\n    edges {\n      node {\n        id\n        requestType\n        requestState\n        dataSubject\n        contact\n        details\n        deadline\n        actionTaken\n        createdAt\n        updatedAt\n        canDelete: permission(action: \"core:rights-request:delete\")\n        canUpdate: permission(action: \"core:rights-request:update\")\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "6ff83d9e0017a4fb245ad9f13106a439";
+(node as any).hash = "0ec5bfd82df0184daee8f615b55f9b5b";
 
 export default node;

apps/console/src/__generated__/core/RightsRequestGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<23949230cfdefa0c2a321d4fa38e3ace>>
+ * @generated SignedSource<<a97e020f188d100e7c82076b6d82f1ec>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -17,6 +17,8 @@ export type RightsRequestGraphNodeQuery$variables = {
 export type RightsRequestGraphNodeQuery$data = {
   readonly node: {
     readonly actionTaken?: string | null | undefined;
+    readonly canDelete?: boolean;
+    readonly canUpdate?: boolean;
     readonly contact?: string | null | undefined;
     readonly createdAt?: string;
     readonly dataSubject?: string | null | undefined;
@@ -109,6 +111,32 @@ v9 = {
   "storageKey": null
 },
 v10 = {
+  "alias": "canUpdate",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:rights-request:update"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:rights-request:update\")"
+},
+v11 = {
+  "alias": "canDelete",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:rights-request:delete"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:rights-request:delete\")"
+},
+v12 = {
   "alias": null,
   "args": null,
   "concreteType": "Organization",
@@ -127,14 +155,14 @@ v10 = {
   ],
   "storageKey": null
 },
-v11 = {
+v13 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "createdAt",
   "storageKey": null
 },
-v12 = {
+v14 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -169,7 +197,9 @@ return {
               (v9/*: any*/),
               (v10/*: any*/),
               (v11/*: any*/),
-              (v12/*: any*/)
+              (v12/*: any*/),
+              (v13/*: any*/),
+              (v14/*: any*/)
             ],
             "type": "RightsRequest",
             "abstractKey": null
@@ -215,7 +245,9 @@ return {
               (v9/*: any*/),
               (v10/*: any*/),
               (v11/*: any*/),
-              (v12/*: any*/)
+              (v12/*: any*/),
+              (v13/*: any*/),
+              (v14/*: any*/)
             ],
             "type": "RightsRequest",
             "abstractKey": null
@@ -226,16 +258,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "93aa5fb44159c0ae2709c34f493bc69f",
+    "cacheID": "ee78ca5ffa5a944254f733bfefdfbfab",
     "id": null,
     "metadata": {},
     "name": "RightsRequestGraphNodeQuery",
     "operationKind": "query",
-    "text": "query RightsRequestGraphNodeQuery(\n  $rightsRequestId: ID!\n) {\n  node(id: $rightsRequestId) {\n    __typename\n    ... on RightsRequest {\n      id\n      requestType\n      requestState\n      dataSubject\n      contact\n      details\n      deadline\n      actionTaken\n      organization {\n        id\n        name\n      }\n      createdAt\n      updatedAt\n    }\n    id\n  }\n}\n"
+    "text": "query RightsRequestGraphNodeQuery(\n  $rightsRequestId: ID!\n) {\n  node(id: $rightsRequestId) {\n    __typename\n    ... on RightsRequest {\n      id\n      requestType\n      requestState\n      dataSubject\n      contact\n      details\n      deadline\n      actionTaken\n      canUpdate: permission(action: \"core:rights-request:update\")\n      canDelete: permission(action: \"core:rights-request:delete\")\n      organization {\n        id\n        name\n      }\n      createdAt\n      updatedAt\n    }\n    id\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "9f7d09c59f937a8de6cfbc0354b42d1b";
+(node as any).hash = "77cc11eb6270df9b753572cf3a14689d";
 
 export default node;

apps/console/src/__generated__/core/RightsRequestsPageFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<10add82cf941c1776c712d87451b6da1>>
+ * @generated SignedSource<<109da5292cbd22b553279fefd5c41c03>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -19,6 +19,8 @@ export type RightsRequestsPageFragment$data = {
     readonly edges: ReadonlyArray<{
       readonly node: {
         readonly actionTaken: string | null | undefined;
+        readonly canDelete: boolean;
+        readonly canUpdate: boolean;
         readonly contact: string | null | undefined;
         readonly createdAt: string;
         readonly dataSubject: string | null | undefined;
@@ -196,6 +198,32 @@ return {
                   "name": "updatedAt",
                   "storageKey": null
                 },
+                {
+                  "alias": "canDelete",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:rights-request:delete"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:rights-request:delete\")"
+                },
+                {
+                  "alias": "canUpdate",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:rights-request:update"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:rights-request:update\")"
+                },
                 {
                   "alias": null,
                   "args": null,
@@ -262,6 +290,6 @@ return {
 };
 })();
 
-(node as any).hash = "3476c393dc97ae3d730ed5715922e987";
+(node as any).hash = "cfb8b464e37afac281c1722b9daf1783";
 
 export default node;

apps/console/src/__generated__/core/RightsRequestsPageRefetchQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<47e719a83abc9c6cb5f5e1140f70cf70>>
+ * @generated SignedSource<<e8285c8dc81c3789af43fe68e8ef4c98>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -217,6 +217,32 @@ return {
                             "name": "updatedAt",
                             "storageKey": null
                           },
+                          {
+                            "alias": "canDelete",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:rights-request:delete"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:rights-request:delete\")"
+                          },
+                          {
+                            "alias": "canUpdate",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:rights-request:update"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:rights-request:update\")"
+                          },
                           (v3/*: any*/)
                         ],
                         "storageKey": null
@@ -290,16 +316,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "10c7e9a6f7813d150e34282befd799ff",
+    "cacheID": "a63c4d960c8f375acceeedd2f1b9a188",
     "id": null,
     "metadata": {},
     "name": "RightsRequestsPageRefetchQuery",
     "operationKind": "query",
-    "text": "query RightsRequestsPageRefetchQuery(\n  $after: CursorKey\n  $first: Int = 10\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...RightsRequestsPageFragment_2HEEH6\n    id\n  }\n}\n\nfragment RightsRequestsPageFragment_2HEEH6 on Organization {\n  id\n  rightsRequests(first: $first, after: $after) {\n    totalCount\n    edges {\n      node {\n        id\n        requestType\n        requestState\n        dataSubject\n        contact\n        details\n        deadline\n        actionTaken\n        createdAt\n        updatedAt\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n    }\n  }\n}\n"
+    "text": "query RightsRequestsPageRefetchQuery(\n  $after: CursorKey\n  $first: Int = 10\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...RightsRequestsPageFragment_2HEEH6\n    id\n  }\n}\n\nfragment RightsRequestsPageFragment_2HEEH6 on Organization {\n  id\n  rightsRequests(first: $first, after: $after) {\n    totalCount\n    edges {\n      node {\n        id\n        requestType\n        requestState\n        dataSubject\n        contact\n        details\n        deadline\n        actionTaken\n        createdAt\n        updatedAt\n        canDelete: permission(action: \"core:rights-request:delete\")\n        canUpdate: permission(action: \"core:rights-request:update\")\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      hasNextPage\n      endCursor\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "3476c393dc97ae3d730ed5715922e987";
+(node as any).hash = "cfb8b464e37afac281c1722b9daf1783";
 
 export default node;

apps/console/src/__generated__/core/StateOfApplicabilityControlsTabFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<306449631752d4277aa96b77601e2d8f>>
+ * @generated SignedSource<<d0252e79888e84b37fc216198d60dd5b>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -26,6 +26,8 @@ export type StateOfApplicabilityControlsTabFragment$data = {
     readonly sectionTitle: string;
     readonly stateOfApplicabilityId: string | null | undefined;
   }>;
+  readonly canCreateStateOfApplicabilityControlMapping: boolean;
+  readonly canDeleteStateOfApplicabilityControlMapping: boolean;
   readonly controlsInfo: {
     readonly totalCount: number;
   };
@@ -88,6 +90,32 @@ const node: ReaderFragment = {
       ],
       "storageKey": "controls(first:0)"
     },
+    {
+      "alias": "canCreateStateOfApplicabilityControlMapping",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:state-of-applicability:control-mapping:create"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:state-of-applicability:control-mapping:create\")"
+    },
+    {
+      "alias": "canDeleteStateOfApplicabilityControlMapping",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "action",
+          "value": "core:state-of-applicability:control-mapping:delete"
+        }
+      ],
+      "kind": "ScalarField",
+      "name": "permission",
+      "storageKey": "permission(action:\"core:state-of-applicability:control-mapping:delete\")"
+    },
     {
       "alias": null,
       "args": null,
@@ -195,6 +223,6 @@ const node: ReaderFragment = {
   "abstractKey": null
 };
 
-(node as any).hash = "e72695289b29d1a4b60e3f7c18ba1165";
+(node as any).hash = "70183a65cc3c55a9ffddb4c2824bf5a7";
 
 export default node;

apps/console/src/__generated__/core/StateOfApplicabilityControlsTabRefetchQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<06d34888ed5b3e0d66f2159e1a916196>>
+ * @generated SignedSource<<e559b5ed1fa680ba3fa253c258d92315>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -120,6 +120,32 @@ return {
                 ],
                 "storageKey": "controls(first:0)"
               },
+              {
+                "alias": "canCreateStateOfApplicabilityControlMapping",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:state-of-applicability:control-mapping:create"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:state-of-applicability:control-mapping:create\")"
+              },
+              {
+                "alias": "canDeleteStateOfApplicabilityControlMapping",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:state-of-applicability:control-mapping:delete"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:state-of-applicability:control-mapping:delete\")"
+              },
               {
                 "alias": null,
                 "args": null,
@@ -232,16 +258,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "50874b763d9f2cfc01d097ec9b68ec82",
+    "cacheID": "7faadf001782b3aae9b9af0ce5ffa7a5",
     "id": null,
     "metadata": {},
     "name": "StateOfApplicabilityControlsTabRefetchQuery",
     "operationKind": "query",
-    "text": "query StateOfApplicabilityControlsTabRefetchQuery(\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityControlsTabFragment\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
+    "text": "query StateOfApplicabilityControlsTabRefetchQuery(\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityControlsTabFragment\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  canCreateStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability:control-mapping:create\")\n  canDeleteStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability:control-mapping:delete\")\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "e72695289b29d1a4b60e3f7c18ba1165";
+(node as any).hash = "70183a65cc3c55a9ffddb4c2824bf5a7";
 
 export default node;

apps/console/src/__generated__/core/StateOfApplicabilityGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<bf2f70e0ed1c6bd3352d100db4cae660>>
+ * @generated SignedSource<<74ef0d7b05d90eaaac07851cfb57409f>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,6 +15,8 @@ export type StateOfApplicabilityGraphNodeQuery$variables = {
 };
 export type StateOfApplicabilityGraphNodeQuery$data = {
   readonly node: {
+    readonly canDelete?: boolean;
+    readonly canUpdate?: boolean;
     readonly createdAt?: string;
     readonly id?: string;
     readonly name?: string;
@@ -94,6 +96,32 @@ v7 = {
   "storageKey": null
 },
 v8 = {
+  "alias": "canUpdate",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:state-of-applicability:update"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:state-of-applicability:update\")"
+},
+v9 = {
+  "alias": "canDelete",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:state-of-applicability:delete"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:state-of-applicability:delete\")"
+},
+v10 = {
   "alias": null,
   "args": null,
   "concreteType": "Organization",
@@ -105,7 +133,7 @@ v8 = {
   ],
   "storageKey": null
 },
-v9 = {
+v11 = {
   "alias": null,
   "args": null,
   "concreteType": "People",
@@ -150,6 +178,8 @@ return {
               (v7/*: any*/),
               (v8/*: any*/),
               (v9/*: any*/),
+              (v10/*: any*/),
+              (v11/*: any*/),
               {
                 "args": null,
                 "kind": "FragmentSpread",
@@ -198,6 +228,8 @@ return {
               (v7/*: any*/),
               (v8/*: any*/),
               (v9/*: any*/),
+              (v10/*: any*/),
+              (v11/*: any*/),
               {
                 "alias": "controlsInfo",
                 "args": [
@@ -222,6 +254,32 @@ return {
                 ],
                 "storageKey": "controls(first:0)"
               },
+              {
+                "alias": "canCreateStateOfApplicabilityControlMapping",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:state-of-applicability:control-mapping:create"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:state-of-applicability:control-mapping:create\")"
+              },
+              {
+                "alias": "canDeleteStateOfApplicabilityControlMapping",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "action",
+                    "value": "core:state-of-applicability:control-mapping:delete"
+                  }
+                ],
+                "kind": "ScalarField",
+                "name": "permission",
+                "storageKey": "permission(action:\"core:state-of-applicability:control-mapping:delete\")"
+              },
               {
                 "alias": null,
                 "args": null,
@@ -328,16 +386,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "2c2c6535c53d2073bd41b39771d1afd9",
+    "cacheID": "dfdfadde088e82025aaa6c9c290f96b6",
     "id": null,
     "metadata": {},
     "name": "StateOfApplicabilityGraphNodeQuery",
     "operationKind": "query",
-    "text": "query StateOfApplicabilityGraphNodeQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      name\n      sourceId\n      snapshotId\n      createdAt\n      updatedAt\n      organization {\n        id\n      }\n      owner {\n        id\n        fullName\n      }\n      ...StateOfApplicabilityControlsTabFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
+    "text": "query StateOfApplicabilityGraphNodeQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      name\n      sourceId\n      snapshotId\n      createdAt\n      updatedAt\n      canUpdate: permission(action: \"core:state-of-applicability:update\")\n      canDelete: permission(action: \"core:state-of-applicability:delete\")\n      organization {\n        id\n      }\n      owner {\n        id\n        fullName\n      }\n      ...StateOfApplicabilityControlsTabFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  canCreateStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability:control-mapping:create\")\n  canDeleteStateOfApplicabilityControlMapping: permission(action: \"core:state-of-applicability:control-mapping:delete\")\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "88e882f3c0f529cc7224eb19a91191cf";
+(node as any).hash = "1a1f3480b9c66597d146c48ed1b00bd1";
 
 export default node;

apps/console/src/__generated__/core/StateOfApplicabilityGraphPaginatedFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<c56844aad03997c31a20815ce775fc24>>
+ * @generated SignedSource<<3472918fdff6205597f39a6310f2ee08>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -16,6 +16,7 @@ export type StateOfApplicabilityGraphPaginatedFragment$data = {
     readonly __id: string;
     readonly edges: ReadonlyArray<{
       readonly node: {
+        readonly canDelete: boolean;
         readonly controlsInfo: {
           readonly totalCount: number;
         };
@@ -191,6 +192,19 @@ return {
                   "name": "updatedAt",
                   "storageKey": null
                 },
+                {
+                  "alias": "canDelete",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "action",
+                      "value": "core:state-of-applicability:delete"
+                    }
+                  ],
+                  "kind": "ScalarField",
+                  "name": "permission",
+                  "storageKey": "permission(action:\"core:state-of-applicability:delete\")"
+                },
                 {
                   "alias": "controlsInfo",
                   "args": [
@@ -296,6 +310,6 @@ return {
 };
 })();
 
-(node as any).hash = "895fc79e61b95bf83997e3d5bcc7f367";
+(node as any).hash = "82cf2a5ce701c34a41f8166371dd75c3";
 
 export default node;

apps/console/src/__generated__/core/StateOfApplicabilityGraphPaginatedQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<1c22107bf5691e7764aa30352d99631e>>
+ * @generated SignedSource<<a1b6d40084a5ddfad764dd1f6fa32607>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -15,8 +15,14 @@ export type StateOfApplicabilityGraphPaginatedQuery$variables = {
 };
 export type StateOfApplicabilityGraphPaginatedQuery$data = {
   readonly organization: {
-    readonly id?: string;
+    readonly __typename: "Organization";
+    readonly canCreateStateOfApplicability: boolean;
+    readonly id: string;
     readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+  } | {
+    // This will never be '%other', but we need some
+    // value in case none of the concrete values match.
+    readonly __typename: "%other";
   };
 };
 export type StateOfApplicabilityGraphPaginatedQuery = {
@@ -43,17 +49,30 @@ v2 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "id",
+  "name": "__typename",
   "storageKey": null
 },
 v3 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "__typename",
+  "name": "id",
   "storageKey": null
 },
-v4 = [
+v4 = {
+  "alias": "canCreateStateOfApplicability",
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "action",
+      "value": "core:state-of-applicability:create"
+    }
+  ],
+  "kind": "ScalarField",
+  "name": "permission",
+  "storageKey": "permission(action:\"core:state-of-applicability:create\")"
+},
+v5 = [
   {
     "kind": "Literal",
     "name": "filter",
@@ -90,10 +109,12 @@ return {
         "name": "node",
         "plural": false,
         "selections": [
+          (v2/*: any*/),
           {
             "kind": "InlineFragment",
             "selections": [
-              (v2/*: any*/),
+              (v3/*: any*/),
+              (v4/*: any*/),
               {
                 "args": null,
                 "kind": "FragmentSpread",
@@ -124,14 +145,15 @@ return {
         "name": "node",
         "plural": false,
         "selections": [
-          (v3/*: any*/),
           (v2/*: any*/),
+          (v3/*: any*/),
           {
             "kind": "InlineFragment",
             "selections": [
+              (v4/*: any*/),
               {
                 "alias": null,
-                "args": (v4/*: any*/),
+                "args": (v5/*: any*/),
                 "concreteType": "StateOfApplicabilityConnection",
                 "kind": "LinkedField",
                 "name": "statesOfApplicability",
@@ -153,7 +175,7 @@ return {
                         "name": "node",
                         "plural": false,
                         "selections": [
-                          (v2/*: any*/),
+                          (v3/*: any*/),
                           {
                             "alias": null,
                             "args": null,
@@ -189,6 +211,19 @@ return {
                             "name": "updatedAt",
                             "storageKey": null
                           },
+                          {
+                            "alias": "canDelete",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:state-of-applicability:delete"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:state-of-applicability:delete\")"
+                          },
                           {
                             "alias": "controlsInfo",
                             "args": [
@@ -213,7 +248,7 @@ return {
                             ],
                             "storageKey": "controls(first:0)"
                           },
-                          (v3/*: any*/)
+                          (v2/*: any*/)
                         ],
                         "storageKey": null
                       },
@@ -283,7 +318,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v4/*: any*/),
+                "args": (v5/*: any*/),
                 "filters": [
                   "orderBy",
                   "filter"
@@ -303,16 +338,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "c5f5cb61622ba5e4309521002c23a530",
+    "cacheID": "3d53dfeb5366c889e790a88116dd3a4a",
     "id": null,
     "metadata": {},
     "name": "StateOfApplicabilityGraphPaginatedQuery",
     "operationKind": "query",
-    "text": "query StateOfApplicabilityGraphPaginatedQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      ...StateOfApplicabilityGraphPaginatedFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment on Organization {\n  statesOfApplicability(first: 50, orderBy: {direction: DESC, field: CREATED_AT}, filter: {snapshotId: null}) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
+    "text": "query StateOfApplicabilityGraphPaginatedQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      canCreateStateOfApplicability: permission(action: \"core:state-of-applicability:create\")\n      ...StateOfApplicabilityGraphPaginatedFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment on Organization {\n  statesOfApplicability(first: 50, orderBy: {direction: DESC, field: CREATED_AT}, filter: {snapshotId: null}) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        canDelete: permission(action: \"core:state-of-applicability:delete\")\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
   }
 };
 })();
 
-(node as any).hash = "e5eb3f251055f7dd34f7af30251226ca";
+(node as any).hash = "2182e7aea21c8eba8b2cfda1e614b6e5";
 
 export default node;

apps/console/src/__generated__/core/StateOfApplicabilityListQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<9026caada1e636b7db342b11e6d324c0>>
+ * @generated SignedSource<<8bdd74dfae1b656006a07b2f89fe525d>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -270,6 +270,19 @@ return {
                             "name": "updatedAt",
                             "storageKey": null
                           },
+                          {
+                            "alias": "canDelete",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "action",
+                                "value": "core:state-of-applicability:delete"
+                              }
+                            ],
+                            "kind": "ScalarField",
+                            "name": "permission",
+                            "storageKey": "permission(action:\"core:state-of-applicability:delete\")"
+                          },
                           {
                             "alias": "controlsInfo",
                             "args": [
@@ -384,16 +397,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "d3227559321509a2a525848a0e26e20b",
+    "cacheID": "68d8b8bc491e464ea692b6d37952bcbf",
     "id": null,
     "metadata": {},
     "name": "StateOfApplicabilityListQuery",
     "operationKind": "query",
-    "text": "query StateOfApplicabilityListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $filter: StateOfApplicabilityFilter = {snapshotId: null}\n  $first: Int = 50\n  $last: Int = null\n  $order: StateOfApplicabilityOrder = {direction: DESC, field: CREATED_AT}\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityGraphPaginatedFragment_4cFWzS\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment_4cFWzS on Organization {\n  statesOfApplicability(first: $first, after: $after, last: $last, before: $before, orderBy: $order, filter: $filter) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
+    "text": "query StateOfApplicabilityListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $filter: StateOfApplicabilityFilter = {snapshotId: null}\n  $first: Int = 50\n  $last: Int = null\n  $order: StateOfApplicabilityOrder = {direction: DESC, field: CREATED_AT}\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityGraphPaginatedFragment_4cFWzS\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment_4cFWzS on Organization {\n  statesOfApplicability(first: $first, after: $after, last: $last, before: $before, orderBy: $order, filter: $filter) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        canDelete: permission(action: \"core:state-of-applicability:delete\")\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
   }
 };
 })();
 
-(node as any).hash = "895fc79e61b95bf83997e3d5bcc7f367";
+(node as any).hash = "82cf2a5ce701c34a41f8166371dd75c3";
 
 export default node;

apps/console/src/__generated__/iam/MembershipLayoutQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<57b1d454985b710fd8d5ccecfa90f97d>>
+ * @generated SignedSource<<698ad015edeb94e58ec661b6118dca4b>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,12 +10,21 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
+export type MembershipRole = "ADMIN" | "AUDITOR" | "EMPLOYEE" | "OWNER" | "VIEWER";
 export type MembershipLayoutQuery$variables = {
   organizationId: string;
 };
 export type MembershipLayoutQuery$data = {
   readonly organization: {
+    readonly __typename: "Organization";
+    readonly viewerMembership: {
+      readonly role: MembershipRole;
+    };
     readonly " $fragmentSpreads": FragmentRefs<"MembershipsDropdown_organizationFragment" | "SessionDropdownFragment" | "SidebarFragment">;
+  } | {
+    // This will never be '%other', but we need some
+    // value in case none of the concrete values match.
+    readonly __typename: "%other";
   };
   readonly viewer: {
     readonly pendingInvitations: {
@@ -48,10 +57,24 @@ v2 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "totalCount",
+  "name": "__typename",
   "storageKey": null
 },
 v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "role",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "totalCount",
+  "storageKey": null
+},
+v5 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -75,6 +98,7 @@ return {
           "name": "node",
           "plural": false,
           "selections": [
+            (v2/*: any*/),
             {
               "kind": "InlineFragment",
               "selections": [
@@ -92,6 +116,22 @@ return {
                   "args": null,
                   "kind": "FragmentSpread",
                   "name": "SidebarFragment"
+                },
+                {
+                  "kind": "RequiredField",
+                  "field": {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "Membership",
+                    "kind": "LinkedField",
+                    "name": "viewerMembership",
+                    "plural": false,
+                    "selections": [
+                      (v3/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  "action": "THROW"
                 }
               ],
               "type": "Organization",
@@ -129,7 +169,7 @@ return {
                 "selections": [
                   {
                     "kind": "RequiredField",
-                    "field": (v2/*: any*/),
+                    "field": (v4/*: any*/),
                     "action": "THROW"
                   }
                 ],
@@ -160,13 +200,7 @@ return {
         "name": "node",
         "plural": false,
         "selections": [
-          {
+          (v2/*: any*/),
-            "alias": null,
-            "args": null,
-            "kind": "ScalarField",
-            "name": "__typename",
-            "storageKey": null
-          },
           {
             "kind": "InlineFragment",
             "selections": [
@@ -213,7 +247,7 @@ return {
                         "name": "email",
                         "storageKey": null
                       },
-                      (v3/*: any*/)
+                      (v5/*: any*/)
                     ],
                     "storageKey": null
                   },
@@ -232,10 +266,11 @@ return {
                         "name": "fullName",
                         "storageKey": null
                       },
-                      (v3/*: any*/)
+                      (v5/*: any*/)
                     ],
                     "storageKey": null
                   },
+                  (v5/*: any*/),
                   (v3/*: any*/)
                 ],
                 "storageKey": null
@@ -504,7 +539,7 @@ return {
             "type": "Organization",
             "abstractKey": null
           },
-          (v3/*: any*/)
+          (v5/*: any*/)
         ],
         "storageKey": null
       },
@@ -524,27 +559,27 @@ return {
             "name": "pendingInvitations",
             "plural": false,
             "selections": [
-              (v2/*: any*/)
+              (v4/*: any*/)
             ],
             "storageKey": null
           },
-          (v3/*: any*/)
+          (v5/*: any*/)
         ],
         "storageKey": null
       }
     ]
   },
   "params": {
-    "cacheID": "7a430121b08c549781c5340bacd630c9",
+    "cacheID": "f39bc9faafcfb9d3e6482e088a3cae1e",
     "id": null,
     "metadata": {},
     "name": "MembershipLayoutQuery",
     "operationKind": "query",
-    "text": "query MembershipLayoutQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      ...MembershipsDropdown_organizationFragment\n      ...SessionDropdownFragment\n      ...SidebarFragment\n    }\n    id\n  }\n  viewer {\n    ...MembershipsDropdown_viewerFragment\n    pendingInvitations {\n      totalCount\n    }\n    id\n  }\n}\n\nfragment MembershipsDropdown_organizationFragment on Organization {\n  name\n}\n\nfragment MembershipsDropdown_viewerFragment on Identity {\n  pendingInvitations {\n    totalCount\n  }\n}\n\nfragment SessionDropdownFragment on Organization {\n  canDelete: permission(action: \"iam:organization:delete\")\n  viewerMembership {\n    identity {\n      email\n      id\n    }\n    profile {\n      fullName\n      id\n    }\n    id\n  }\n}\n\nfragment SidebarFragment on Organization {\n  canListMeetings: permission(action: \"core:meeting:list\")\n  canListTasks: permission(action: \"core:task:list\")\n  canListMeasures: permission(action: \"core:measures:list\")\n  canListRisks: permission(action: \"core:risk:list\")\n  canListFrameworks: permission(action: \"core:frameworks:list\")\n  canListPeople: permission(action: \"core:people:list\")\n  canListVendors: permission(action: \"core:vendor:list\")\n  canListDocuments: permission(action: \"core:document:list\")\n  canListAssets: permission(action: \"core:asset:list\")\n  canListData: permission(action: \"core:datum:list\")\n  canListAudits: permission(action: \"core:audit:list\")\n  canListNonconformities: permission(action: \"core:nonconformity:list\")\n  canListObligations: permission(action: \"core:obligation:list\")\n  canListContinualImprovements: permission(action: \"core:continual-improvement:list\")\n  canListProcessingActivities: permission(action: \"core:processing-activity:list\")\n  canListRightsRequests: permission(action: \"core:rights-request:list\")\n  canListSnapshots: permission(action: \"core:snapshot:list\")\n  canGetTrustCenter: permission(action: \"core:trust-center:get\")\n  canUpdateOrganization: permission(action: \"iam:organization:update\")\n  canListStatesOfApplicability: permission(action: \"core:state-of-applicability:list\")\n}\n"
+    "text": "query MembershipLayoutQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      ...MembershipsDropdown_organizationFragment\n      ...SessionDropdownFragment\n      ...SidebarFragment\n      viewerMembership {\n        role\n        id\n      }\n    }\n    id\n  }\n  viewer {\n    ...MembershipsDropdown_viewerFragment\n    pendingInvitations {\n      totalCount\n    }\n    id\n  }\n}\n\nfragment MembershipsDropdown_organizationFragment on Organization {\n  name\n}\n\nfragment MembershipsDropdown_viewerFragment on Identity {\n  pendingInvitations {\n    totalCount\n  }\n}\n\nfragment SessionDropdownFragment on Organization {\n  canDelete: permission(action: \"iam:organization:delete\")\n  viewerMembership {\n    identity {\n      email\n      id\n    }\n    profile {\n      fullName\n      id\n    }\n    id\n  }\n}\n\nfragment SidebarFragment on Organization {\n  canListMeetings: permission(action: \"core:meeting:list\")\n  canListTasks: permission(action: \"core:task:list\")\n  canListMeasures: permission(action: \"core:measures:list\")\n  canListRisks: permission(action: \"core:risk:list\")\n  canListFrameworks: permission(action: \"core:frameworks:list\")\n  canListPeople: permission(action: \"core:people:list\")\n  canListVendors: permission(action: \"core:vendor:list\")\n  canListDocuments: permission(action: \"core:document:list\")\n  canListAssets: permission(action: \"core:asset:list\")\n  canListData: permission(action: \"core:datum:list\")\n  canListAudits: permission(action: \"core:audit:list\")\n  canListNonconformities: permission(action: \"core:nonconformity:list\")\n  canListObligations: permission(action: \"core:obligation:list\")\n  canListContinualImprovements: permission(action: \"core:continual-improvement:list\")\n  canListProcessingActivities: permission(action: \"core:processing-activity:list\")\n  canListRightsRequests: permission(action: \"core:rights-request:list\")\n  canListSnapshots: permission(action: \"core:snapshot:list\")\n  canGetTrustCenter: permission(action: \"core:trust-center:get\")\n  canUpdateOrganization: permission(action: \"iam:organization:update\")\n  canListStatesOfApplicability: permission(action: \"core:state-of-applicability:list\")\n}\n"
   }
 };
 })();
 
-(node as any).hash = "9a87ccbe2aa86cca7845e0145b133921";
+(node as any).hash = "6e16255ebbb75840ce8ec057a453bbf0";
 
 export default node;

apps/console/src/hooks/graph/RightsRequestGraph.ts

@@ -11,6 +11,7 @@ export const rightsRequestsQuery = graphql`
   query RightsRequestGraphListQuery($organizationId: ID!) {
     node(id: $organizationId) {
       ... on Organization {
+        canCreateRightsRequest: permission(action: "core:rights-request:create")
         ...RightsRequestsPageFragment
       }
     }
@@ -29,6 +30,8 @@ export const rightsRequestNodeQuery = graphql`
         details
         deadline
         actionTaken
+        canUpdate: permission(action: "core:rights-request:update")
+        canDelete: permission(action: "core:rights-request:delete")
         organization {
           id
           name

apps/console/src/hooks/graph/StateOfApplicabilityGraph.ts

@@ -20,8 +20,10 @@ import { useTranslate } from "@probo/i18n";
 export const paginatedStateOfApplicabilityQuery = graphql`
   query StateOfApplicabilityGraphPaginatedQuery($organizationId: ID!) {
     organization: node(id: $organizationId) {
+      __typename
       ... on Organization {
         id
+        canCreateStateOfApplicability: permission(action: "core:state-of-applicability:create")
         ...StateOfApplicabilityGraphPaginatedFragment
       }
     }
@@ -59,6 +61,9 @@ export const paginatedStateOfApplicabilityFragment = graphql`
           snapshotId
           createdAt
           updatedAt
+
+          canDelete: permission(action: "core:state-of-applicability:delete")
+
           controlsInfo: controls(first: 0) {
             totalCount
           }
@@ -197,6 +202,8 @@ export const stateOfApplicabilityNodeQuery = graphql`
         snapshotId
         createdAt
         updatedAt
+        canUpdate: permission(action: "core:state-of-applicability:update")
+        canDelete: permission(action: "core:state-of-applicability:delete")
         organization {
           id
         }

apps/console/src/layouts/MainLayout.tsx

@@ -1,556 +0,0 @@
-import { useTranslate } from "@probo/i18n";
-import {
-  Avatar,
-  Badge,
-  Button,
-  Dropdown,
-  DropdownItem,
-  DropdownSeparator,
-  IconArrowBoxLeft,
-  IconBank,
-  IconBook,
-  IconBox,
-  IconCalendar2,
-  IconCheckmark1,
-  IconChevronGrabberVertical,
-  IconCircleProgress,
-  IconCircleQuestionmark,
-  IconClock,
-  IconCrossLargeX,
-  IconFire3,
-  IconGroup1,
-  IconInboxEmpty,
-  IconKey,
-  IconListStack,
-  IconLock,
-  IconMagnifyingGlass,
-  IconMedal,
-  IconPageTextLine,
-  IconPeopleAdd,
-  IconPlusLarge,
-  IconRotateCw,
-  IconSettingsGear2,
-  IconShield,
-  IconStore,
-  IconTodo,
-  Input,
-  Layout,
-  SidebarItem,
-  Skeleton,
-  UserDropdownItem,
-  UserDropdown as UserDropdownRoot,
-  useToast,
-} from "@probo/ui";
-import { Suspense, use, useEffect, useMemo, useState } from "react";
-import { ErrorBoundary } from "react-error-boundary";
-import { useLazyLoadQuery } from "react-relay";
-import { Link, Navigate, Outlet, useParams } from "react-router";
-import { graphql } from "relay-runtime";
-import type { MainLayoutQuery as MainLayoutQueryType } from "/__generated__/core/MainLayoutQuery.graphql";
-import { PageError } from "/components/PageError";
-import { PermissionsProvider } from "/providers/PermissionsProvider";
-import { PermissionsContext } from "/providers/PermissionsContext";
-
-const MainLayoutQuery = graphql`
-  query MainLayoutQuery($organizationId: ID!) {
-    viewer {
-      id
-    }
-    organization: node(id: $organizationId) {
-      ... on Organization {
-        id
-        name
-        logoUrl
-      }
-    }
-  }
-`;
-
-/**
- * Site layout with a header and a sidebar
- */
-export function MainLayout() {
-  const { organizationId } = useParams();
-
-  const prefix = `/organizations/${organizationId}`;
-
-  if (!organizationId) {
-    return <Navigate to="/" />;
-  }
-
-  return (
-    <Suspense fallback={<Skeleton className="w-full h-screen" />}>
-      <PermissionsProvider>
-        <MainLayoutContent organizationId={organizationId} prefix={prefix} />
-      </PermissionsProvider>
-    </Suspense>
-  );
-}
-
-function MainLayoutContent({
-  organizationId,
-  prefix,
-}: {
-  organizationId: string;
-  prefix: string;
-}) {
-  const { __ } = useTranslate();
-  const { isAuthorized } = use(PermissionsContext);
-  const data = useLazyLoadQuery<MainLayoutQueryType>(MainLayoutQuery, {
-    organizationId,
-  });
-
-  return (
-    <Layout
-      header={
-        <>
-          <div className="mr-auto">
-            <OrganizationSelector currentOrganization={data.organization} />
-          </div>
-          <Suspense fallback={<Skeleton className="w-32 h-8" />}>
-            <UserDropdown organizationId={organizationId} />
-          </Suspense>
-        </>
-      }
-      sidebar={
-        <ul className="space-y-[2px]">
-          {isAuthorized("Organization", "listMeetings") && (
-            <SidebarItem
-              label={__("Meetings")}
-              icon={IconCalendar2}
-              to={`${prefix}/meetings`}
-            />
-          )}
-          {isAuthorized("Organization", "listTasks") && (
-            <SidebarItem
-              label={__("Tasks")}
-              icon={IconInboxEmpty}
-              to={`${prefix}/tasks`}
-            />
-          )}
-          {isAuthorized("Organization", "listMeasures") && (
-            <SidebarItem
-              label={__("Measures")}
-              icon={IconTodo}
-              to={`${prefix}/measures`}
-            />
-          )}
-          {isAuthorized("Organization", "listRisks") && (
-            <SidebarItem
-              label={__("Risks")}
-              icon={IconFire3}
-              to={`${prefix}/risks`}
-            />
-          )}
-          {isAuthorized("Organization", "listFrameworks") && (
-            <SidebarItem
-              label={__("Frameworks")}
-              icon={IconBank}
-              to={`${prefix}/frameworks`}
-            />
-          )}
-          {isAuthorized("Organization", "listPeople") && (
-            <SidebarItem
-              label={__("People")}
-              icon={IconGroup1}
-              to={`${prefix}/people`}
-            />
-          )}
-          {isAuthorized("Organization", "listVendors") && (
-            <SidebarItem
-              label={__("Vendors")}
-              icon={IconStore}
-              to={`${prefix}/vendors`}
-            />
-          )}
-          {isAuthorized("Organization", "listDocuments") && (
-            <SidebarItem
-              label={__("Documents")}
-              icon={IconPageTextLine}
-              to={`${prefix}/documents`}
-            />
-          )}
-          {isAuthorized("Organization", "listAssets") && (
-            <SidebarItem
-              label={__("Assets")}
-              icon={IconBox}
-              to={`${prefix}/assets`}
-            />
-          )}
-          {isAuthorized("Organization", "listData") && (
-            <SidebarItem
-              label={__("Data")}
-              icon={IconListStack}
-              to={`${prefix}/data`}
-            />
-          )}
-          {isAuthorized("Organization", "listAudits") && (
-            <SidebarItem
-              label={__("Audits")}
-              icon={IconMedal}
-              to={`${prefix}/audits`}
-            />
-          )}
-          {isAuthorized("Organization", "listNonconformities") && (
-            <SidebarItem
-              label={__("Nonconformities")}
-              icon={IconCrossLargeX}
-              to={`${prefix}/nonconformities`}
-            />
-          )}
-          {isAuthorized("Organization", "listObligations") && (
-            <SidebarItem
-              label={__("Obligations")}
-              icon={IconBook}
-              to={`${prefix}/obligations`}
-            />
-          )}
-          {isAuthorized("Organization", "listContinualImprovements") && (
-            <SidebarItem
-              label={__("Continual Improvements")}
-              icon={IconRotateCw}
-              to={`${prefix}/continual-improvements`}
-            />
-          )}
-          {isAuthorized("Organization", "listProcessingActivities") && (
-            <SidebarItem
-              label={__("Processing Activities")}
-              icon={IconCircleProgress}
-              to={`${prefix}/processing-activities`}
-            />
-          )}
-          {isAuthorized("Organization", "listRightsRequests") && (
-            <SidebarItem
-              label={__("Rights Requests")}
-              icon={IconLock}
-              to={`${prefix}/rights-requests`}
-            />
-          )}
-          {isAuthorized("Organization", "listSnapshots") && (
-            <SidebarItem
-              label={__("Snapshots")}
-              icon={IconClock}
-              to={`${prefix}/snapshots`}
-            />
-          )}
-          {isAuthorized("Organization", "getTrustCenter") && (
-            <SidebarItem
-              label={__("Trust Center")}
-              icon={IconShield}
-              to={`${prefix}/trust-center`}
-            />
-          )}
-          {isAuthorized("Organization", "listMembers") && (
-            <SidebarItem
-              label={__("Settings")}
-              icon={IconSettingsGear2}
-              to={`${prefix}/settings`}
-            />
-          )}
-        </ul>
-      }
-    >
-      <ErrorBoundary FallbackComponent={PageError}>
-        <Outlet />
-      </ErrorBoundary>
-    </Layout>
-  );
-}
-
-function UserDropdown({ organizationId }: { organizationId: string }) {
-  const { __ } = useTranslate();
-  const { toast } = useToast();
-  const { isAuthorized } = use(PermissionsContext);
-  // const user = useLazyLoadQuery<MainLayoutQueryType>(MainLayoutQuery, {
-  //   organizationId,
-  // }).viewer.user;
-  const user = {
-    fullName: "",
-    email: "",
-  };
-
-  const handleLogout: React.MouseEventHandler<HTMLAnchorElement> = async (
-    e,
-  ) => {
-    e.preventDefault();
-
-    fetch("/connect/logout", {
-      method: "DELETE",
-      headers: {
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({}),
-    })
-      .then(async (res) => {
-        if (!res.ok) {
-          const error = await res.json();
-          throw new Error(error.message || __("Failed to login"));
-        }
-
-        window.location.reload();
-      })
-      .catch((e) => {
-        toast({
-          title: __("Error"),
-          description: e.message as string,
-          variant: "error",
-        });
-      });
-  };
-
-  return (
-    <UserDropdownRoot fullName={user.fullName} email={user.email}>
-      {isAuthorized("Organization", "deleteOrganization") && (
-        <UserDropdownItem
-          to="/api-keys"
-          icon={IconKey}
-          label={__("API Keys")}
-        />
-      )}
-      {isAuthorized("Organization", "listSignableDocuments") && (
-        <UserDropdownItem
-          to={`/organizations/${organizationId}/employee`}
-          icon={IconPageTextLine}
-          label={__("My Signatures")}
-        />
-      )}
-      <UserDropdownItem
-        to="mailto:support@getprobo.com"
-        icon={IconCircleQuestionmark}
-        label={__("Help")}
-      />
-      <DropdownSeparator />
-      <UserDropdownItem
-        variant="danger"
-        to="/logout"
-        icon={IconArrowBoxLeft}
-        label="Logout"
-        onClick={handleLogout}
-      />
-    </UserDropdownRoot>
-  );
-}
-
-interface Organization {
-  id: string;
-  name: string;
-  logoUrl?: string | null;
-  authenticationMethod: string;
-  authStatus: "authenticated" | "unauthenticated" | "expired";
-  loginUrl: string;
-}
-
-interface OrganizationsResponse {
-  organizations: Organization[];
-}
-
-interface Invitation {
-  id: string;
-  email: string;
-  fullName: string;
-  role: string;
-  expiresAt: string;
-  acceptedAt?: string | null;
-  createdAt: string;
-  organization: {
-    id: string;
-    name: string;
-  };
-}
-
-interface InvitationsResponse {
-  invitations: Invitation[];
-}
-
-function OrganizationSelector({
-  currentOrganization,
-}: {
-  currentOrganization: MainLayoutQueryType["response"]["organization"];
-}) {
-  const [organizations, setOrganizations] = useState<Organization[]>([]);
-  const [pendingInvitationsCount, setPendingInvitationsCount] = useState(0);
-  const [isLoading, setIsLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
-  const [search, setSearch] = useState("");
-  const { __ } = useTranslate();
-
-  const filteredOrganizations = useMemo(() => {
-    if (!search.trim()) {
-      return organizations;
-    }
-    return organizations.filter((org) =>
-      org.name.toLowerCase().includes(search.toLowerCase()),
-    );
-  }, [organizations, search]);
-
-  useEffect(() => {
-    const fetchData = async () => {
-      try {
-        setIsLoading(true);
-
-        const [orgsResponse, invitationsResponse] = await Promise.all([
-          fetch("/connect/organizations", { credentials: "include" }),
-          fetch("/connect/invitations", { credentials: "include" }),
-        ]);
-
-        if (!orgsResponse.ok) {
-          throw new Error("Failed to fetch organizations");
-        }
-
-        if (!invitationsResponse.ok) {
-          throw new Error("Failed to fetch invitations");
-        }
-
-        const orgsData: OrganizationsResponse = await orgsResponse.json();
-        const invitationsData: InvitationsResponse =
-          await invitationsResponse.json();
-
-        const pendingCount = invitationsData.invitations.filter(
-          (inv) => !inv.acceptedAt,
-        ).length;
-
-        setOrganizations(orgsData.organizations);
-        setPendingInvitationsCount(pendingCount);
-        setError(null);
-      } catch (err) {
-        setError(err instanceof Error ? err.message : "Unknown error");
-        console.error("Failed to fetch data:", err);
-      } finally {
-        setIsLoading(false);
-      }
-    };
-
-    fetchData();
-  }, []);
-
-  if (error) {
-    return (
-      <div className="flex items-center gap-1">
-        <Button className="-ml-3" variant="tertiary" disabled>
-          {__("Error loading organizations")}
-        </Button>
-      </div>
-    );
-  }
-
-  return (
-    <div className="flex items-center gap-1">
-      <Dropdown
-        toggle={
-          <Button
-            className="-ml-3"
-            variant="tertiary"
-            iconAfter={IconChevronGrabberVertical}
-            disabled={isLoading}
-          >
-            {isLoading ? __("Loading...") : currentOrganization?.name || ""}
-          </Button>
-        }
-      >
-        <div className="px-3 py-2">
-          <Input
-            icon={IconMagnifyingGlass}
-            placeholder={__("Search organizations...")}
-            value={search}
-            onValueChange={setSearch}
-            onKeyDown={(e) => {
-              e.stopPropagation();
-            }}
-            autoFocus
-          />
-        </div>
-        <div className="max-h-150 overflow-y-auto scrollbar-thin scrollbar-thumb-gray-300 scrollbar-track-transparent hover:scrollbar-thumb-gray-400">
-          {isLoading ? (
-            <div className="px-3 py-2 text-gray-500">
-              {__("Loading organizations...")}
-            </div>
-          ) : filteredOrganizations.length === 0 ? (
-            <div className="px-3 py-2 text-txt-secondary">
-              {__("No organizations found")}
-            </div>
-          ) : (
-            filteredOrganizations.map((organization) => {
-              const isAuthenticated =
-                organization.authStatus === "authenticated";
-              const isExpired = organization.authStatus === "expired";
-              const needsAuth = organization.authStatus === "unauthenticated";
-
-              const targetUrl = isAuthenticated
-                ? `/organizations/${organization.id}`
-                : organization.loginUrl;
-
-              const isSAMLUrl = targetUrl.includes("/connect/saml/");
-
-              // Use organization endpoint for all logos for consistency
-              const logoUrl = organization.logoUrl;
-
-              return (
-                <DropdownItem asChild key={organization.id}>
-                  {isSAMLUrl ? (
-                    <a href={targetUrl} className="flex items-center gap-2">
-                      <Avatar name={organization.name} src={logoUrl} />
-                      <span className="flex-1">{organization.name}</span>
-                      {isAuthenticated && (
-                        <IconCheckmark1 size={16} className="text-green-600" />
-                      )}
-                      {isExpired && (
-                        <IconClock size={16} className="text-orange-600" />
-                      )}
-                      {needsAuth && (
-                        <IconLock size={16} className="text-gray-400" />
-                      )}
-                    </a>
-                  ) : (
-                    <Link to={targetUrl} className="flex items-center gap-2">
-                      <Avatar name={organization.name} src={logoUrl} />
-                      <span className="flex-1">{organization.name}</span>
-                      {isAuthenticated && (
-                        <IconCheckmark1 size={16} className="text-green-600" />
-                      )}
-                      {isExpired && (
-                        <IconClock size={16} className="text-orange-600" />
-                      )}
-                      {needsAuth && (
-                        <IconLock size={16} className="text-gray-400" />
-                      )}
-                    </Link>
-                  )}
-                </DropdownItem>
-              );
-            })
-          )}
-        </div>
-        <DropdownSeparator />
-        {pendingInvitationsCount > 0 && (
-          <DropdownItem asChild>
-            <Link to="/">
-              <IconPeopleAdd size={16} />
-              <span className="flex-1">{__("Invitations")}</span>
-              <Badge variant="info" size="sm">
-                {pendingInvitationsCount}
-              </Badge>
-            </Link>
-          </DropdownItem>
-        )}
-        <DropdownItem asChild>
-          <Link to="/organizations/new">
-            <IconPlusLarge size={16} />
-            {__("Add organization")}
-          </Link>
-        </DropdownItem>
-      </Dropdown>
-      {pendingInvitationsCount > 0 && (
-        <Link to="/" className="relative" title={__("Invitations")}>
-          <Button variant="tertiary" icon={IconPeopleAdd} />
-          <Badge
-            variant="info"
-            size="sm"
-            className="absolute -top-1 -right-1 min-w-[20px] h-5 flex items-center justify-center"
-          >
-            {pendingInvitationsCount}
-          </Badge>
-        </Link>
-      )}
-    </div>
-  );
-}

apps/console/src/pages/iam/memberships/MembershipLayout.tsx

@@ -12,10 +12,14 @@ import { CoreRelayProvider } from "/providers/CoreRelayProvider";
 export const membershipLayoutQuery = graphql`
   query MembershipLayoutQuery($organizationId: ID!) {
     organization: node(id: $organizationId) @required(action: THROW) {
+      __typename
       ... on Organization {
         ...MembershipsDropdown_organizationFragment
         ...SessionDropdownFragment
         ...SidebarFragment
+        viewerMembership @required(action: THROW) {
+          role
+        }
       }
     }
     viewer @required(action: THROW) {
@@ -38,6 +42,9 @@ export function MembershipLayout(props: {
     membershipLayoutQuery,
     queryRef,
   );
+  if (organization.__typename !== "Organization") {
+    throw new Error("invalid type for organization node");
+  }
 
   return (
     <Layout
@@ -69,7 +76,7 @@ export function MembershipLayout(props: {
       sidebar={<Sidebar fKey={organization} />}
     >
       <CoreRelayProvider>
-        <Outlet />
+        <Outlet context={organization.viewerMembership.role} />
       </CoreRelayProvider>
     </Layout>
   );

apps/console/src/pages/organizations/rightsRequests/RightsRequestDetailsPage.tsx

@@ -41,8 +41,6 @@ import {
 } from "@probo/helpers";
 import z from "zod";
 import type { RightsRequestGraphNodeQuery } from "/__generated__/core/RightsRequestGraphNodeQuery.graphql";
-import { use } from "react";
-import { PermissionsContext } from "/providers/PermissionsContext";
 
 const updateRequestSchema = z.object({
     requestType: z.enum(["ACCESS", "DELETION", "PORTABILITY"]),
@@ -67,7 +65,6 @@ export default function RightsRequestDetailsPage(props: Props) {
     const { __ } = useTranslate();
     const { toast } = useToast();
     const organizationId = useOrganizationId();
-  const { isAuthorized } = use(PermissionsContext);
 
     const updateRequest = useUpdateRightsRequest();
 
@@ -136,11 +133,14 @@ export default function RightsRequestDetailsPage(props: Props) {
             <div className="flex items-center justify-between">
                 <Breadcrumb
                     items={[
-            { label: __("Rights Requests"), to: breadcrumbRequestsUrl },
+                        {
+                            label: __("Rights Requests"),
+                            to: breadcrumbRequestsUrl,
+                        },
                         { label: request.dataSubject || request.id! },
                     ]}
                 />
-        {isAuthorized("RightsRequest", "deleteRightsRequest") && (
+                {request.canDelete && (
                     <ActionDropdown>
                         <DropdownItem onClick={deleteRequest} variant="danger">
                             {__("Delete")}
@@ -154,17 +154,26 @@ export default function RightsRequestDetailsPage(props: Props) {
                     <div className="mb-6">
                         <div className="flex items-center gap-4">
                             <h1 className="text-2xl font-bold">
-                {getRightsRequestTypeLabel(__, request.requestType || "ACCESS")}
+                                {getRightsRequestTypeLabel(
+                                    __,
+                                    request.requestType || "ACCESS",
+                                )}
                             </h1>
                             <Badge variant="neutral">
-                {getRightsRequestTypeLabel(__, request.requestType || "ACCESS")}
+                                {getRightsRequestTypeLabel(
+                                    __,
+                                    request.requestType || "ACCESS",
+                                )}
                             </Badge>
                             <Badge
                                 variant={getRightsRequestStateVariant(
                                     request.requestState || "TODO",
                                 )}
                             >
-                {getRightsRequestStateLabel(__, request.requestState || "TODO")}
+                                {getRightsRequestStateLabel(
+                                    __,
+                                    request.requestState || "TODO",
+                                )}
                             </Badge>
                         </div>
                     </div>
@@ -177,16 +186,26 @@ export default function RightsRequestDetailsPage(props: Props) {
                                 render={({ field }) => (
                                     <div>
                                         <Label>{__("Request Type")} *</Label>
-                    <Select value={field.value} onValueChange={field.onChange}>
+                                        <Select
+                                            value={field.value}
+                                            onValueChange={field.onChange}
+                                        >
                                             {typeOptions.map((option) => (
-                        <Option key={option.value} value={option.value}>
+                                                <Option
+                                                    key={option.value}
+                                                    value={option.value}
+                                                >
                                                     {option.label}
                                                 </Option>
                                             ))}
                                         </Select>
-                    {formState.errors.requestType?.message && (
+                                        {formState.errors.requestType
+                                            ?.message && (
                                             <div className="text-red-500 text-sm mt-1">
-                        {formState.errors.requestType.message}
+                                                {
+                                                    formState.errors.requestType
+                                                        .message
+                                                }
                                             </div>
                                         )}
                                     </div>
@@ -199,16 +218,26 @@ export default function RightsRequestDetailsPage(props: Props) {
                                 render={({ field }) => (
                                     <div>
                                         <Label>{__("State")} *</Label>
-                    <Select value={field.value} onValueChange={field.onChange}>
+                                        <Select
+                                            value={field.value}
+                                            onValueChange={field.onChange}
+                                        >
                                             {stateOptions.map((option) => (
-                        <Option key={option.value} value={option.value}>
+                                                <Option
+                                                    key={option.value}
+                                                    value={option.value}
+                                                >
                                                     {option.label}
                                                 </Option>
                                             ))}
                                         </Select>
-                    {formState.errors.requestState?.message && (
+                                        {formState.errors.requestState
+                                            ?.message && (
                                             <div className="text-red-500 text-sm mt-1">
-                        {formState.errors.requestState.message}
+                                                {
+                                                    formState.errors
+                                                        .requestState.message
+                                                }
                                             </div>
                                         )}
                                     </div>
@@ -269,7 +298,7 @@ export default function RightsRequestDetailsPage(props: Props) {
                         </div>
 
                         <div className="flex justify-end pt-4">
-              {isAuthorized("RightsRequest", "updateRightsRequest") && (
+                            {request.canUpdate && (
                                 <Button
                                     type="submit"
                                     variant="primary"

apps/console/src/pages/organizations/rightsRequests/RightsRequestsPage.tsx

@@ -45,8 +45,6 @@ import type {
     RightsRequestsPageFragment$key,
     RightsRequestsPageFragment$data,
 } from "/__generated__/core/RightsRequestsPageFragment.graphql";
-import { use } from "react";
-import { PermissionsContext } from "/providers/PermissionsContext";
 import type { RightsRequestGraphListQuery } from "/__generated__/core/RightsRequestGraphListQuery.graphql";
 
 interface RightsRequestsPageProps {
@@ -77,6 +75,9 @@ const rightsRequestsPageFragment = graphql`
                     actionTaken
                     createdAt
                     updatedAt
+
+                    canDelete: permission(action: "core:rights-request:delete")
+                    canUpdate: permission(action: "core:rights-request:update")
                 }
             }
             pageInfo {
@@ -92,11 +93,13 @@ export default function RightsRequestsPage({
 }: RightsRequestsPageProps) {
     const { __ } = useTranslate();
     const organizationId = useOrganizationId();
-  const { isAuthorized } = use(PermissionsContext);
 
     usePageTitle(__("Rights Requests"));
 
-  const organization = usePreloadedQuery(rightsRequestsQuery, queryRef);
+    const organization = usePreloadedQuery<RightsRequestGraphListQuery>(
+        rightsRequestsQuery,
+        queryRef,
+    );
 
     const { data, loadNext, hasNext, isLoadingNext } = usePaginationFragment<
         RightsRequestGraphListQuery,
@@ -107,11 +110,12 @@ export default function RightsRequestsPage({
         organizationId,
         RightsRequestsConnectionKey,
     );
-  const requests = data?.rightsRequests?.edges?.map((edge) => edge.node) ?? [];
+    const requests =
+        data?.rightsRequests?.edges?.map((edge) => edge.node) ?? [];
 
-  const hasAnyAction =
+    const hasAnyAction = requests.some(
-    isAuthorized("RightsRequest", "updateRightsRequest") ||
+        ({ canUpdate, canDelete }) => canUpdate || canDelete,
-    isAuthorized("RightsRequest", "deleteRightsRequest");
+    );
 
     return (
         <div className="space-y-6">
@@ -119,12 +123,14 @@ export default function RightsRequestsPage({
                 title={__("Rights Requests")}
                 description={__("Manage data subject rights requests.")}
             >
-        {isAuthorized("Organization", "createRightsRequest") && (
+                {organization.node.canCreateRightsRequest && (
                     <CreateRightsRequestDialog
                         organizationId={organizationId}
                         connectionId={connectionId}
                     >
-            <Button icon={IconPlusLarge}>{__("Add rights request")}</Button>
+                        <Button icon={IconPlusLarge}>
+                            {__("Add rights request")}
+                        </Button>
                     </CreateRightsRequestDialog>
                 )}
             </PageHeader>
@@ -161,7 +167,9 @@ export default function RightsRequestsPage({
                                 onClick={() => loadNext(10)}
                                 disabled={isLoadingNext}
                             >
-                {isLoadingNext ? __("Loading...") : __("Load more")}
+                                {isLoadingNext
+                                    ? __("Loading...")
+                                    : __("Load more")}
                             </Button>
                         </div>
                     )}
@@ -173,7 +181,9 @@ export default function RightsRequestsPage({
                             {__("No rights requests yet")}
                         </h3>
                         <p className="text-txt-tertiary mb-4">
-              {__("Create your first rights request to get started.")}
+                            {__(
+                                "Create your first rights request to get started.",
+                            )}
                         </p>
                     </div>
                 </Card>
@@ -197,7 +207,6 @@ function RequestRow({
     const { __ } = useTranslate();
     const [deleteRequest] = useMutation(deleteRightsRequestMutation);
     const confirm = useConfirm();
-  const { isAuthorized } = use(PermissionsContext);
 
     const handleDelete = () => {
         confirm(
@@ -230,7 +239,9 @@ function RequestRow({
                 </Badge>
             </Td>
             <Td>
-        <Badge variant={getRightsRequestStateVariant(request.requestState)}>
+                <Badge
+                    variant={getRightsRequestStateVariant(request.requestState)}
+                >
                     {getRightsRequestStateLabel(__, request.requestState)}
                 </Badge>
             </Td>
@@ -242,13 +253,15 @@ function RequestRow({
                         {formatDate(request.deadline)}
                     </time>
                 ) : (
-          <span className="text-txt-tertiary">{__("No deadline")}</span>
+                    <span className="text-txt-tertiary">
+                        {__("No deadline")}
+                    </span>
                 )}
             </Td>
             {hasAnyAction && (
                 <Td noLink width={50} className="text-end">
                     <ActionDropdown>
-            {isAuthorized("RightsRequest", "deleteRightsRequest") && (
+                        {request.canDelete && (
                             <DropdownItem
                                 icon={IconTrashCan}
                                 variant="danger"

apps/console/src/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage.tsx

@@ -29,8 +29,7 @@ import {
     useDeleteStateOfApplicability,
     updateStateOfApplicabilityMutation,
 } from "/hooks/graph/StateOfApplicabilityGraph";
-import { use, useState, Suspense } from "react";
+import { useState, Suspense } from "react";
-import { PermissionsContext } from "/providers/PermissionsContext";
 import { usePageTitle } from "@probo/hooks";
 import { formatDate, validateSnapshotConsistency } from "@probo/helpers";
 import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
@@ -67,7 +66,6 @@ export default function StateOfApplicabilityDetailPage(props: Props) {
     const stateOfApplicability = data.node;
     const { __ } = useTranslate();
     const navigate = useNavigate();
-    const { isAuthorized } = use(PermissionsContext);
     const isSnapshotMode = Boolean(snapshotId);
 
     if (!stateOfApplicabilityId || !stateOfApplicability) {
@@ -104,12 +102,8 @@ export default function StateOfApplicabilityDetailPage(props: Props) {
         },
     );
 
-    const canUpdate =
+    const canUpdate = !isSnapshotMode && stateOfApplicability.canUpdate;
-        !isSnapshotMode &&
+    const canDelete = !isSnapshotMode && stateOfApplicability.canDelete;
-        isAuthorized("StateOfApplicability", "updateStateOfApplicability");
-    const canDelete =
-        !isSnapshotMode &&
-        isAuthorized("StateOfApplicability", "deleteStateOfApplicability");
 
     const [exportStateOfApplicabilityPDF, isExporting] =
         useMutationWithToasts<StateOfApplicabilityDetailPageExportMutation>(

apps/console/src/pages/organizations/states-of-applicability/StatesOfApplicabilityPage.tsx

@@ -15,21 +15,29 @@ import {
 } from "@probo/ui";
 import { useTranslate } from "@probo/i18n";
 import type { StateOfApplicabilityGraphPaginatedQuery } from "/__generated__/core/StateOfApplicabilityGraphPaginatedQuery.graphql";
-import { type PreloadedQuery } from "react-relay";
 import {
-    useStateOfApplicabilityQuery,
+    usePreloadedQuery,
+    type PreloadedQuery,
+    usePaginationFragment,
+} from "react-relay";
+import {
     useDeleteStateOfApplicability,
+    paginatedStateOfApplicabilityFragment,
+    paginatedStateOfApplicabilityQuery,
 } from "/hooks/graph/StateOfApplicabilityGraph";
-import type { StateOfApplicabilityGraphPaginatedFragment$data } from "/__generated__/core/StateOfApplicabilityGraphPaginatedFragment.graphql";
+import type {
+    StateOfApplicabilityGraphPaginatedFragment$data,
+    StateOfApplicabilityGraphPaginatedFragment$key,
+} from "/__generated__/core/StateOfApplicabilityGraphPaginatedFragment.graphql";
 import type { NodeOf } from "/types";
 import { usePageTitle } from "@probo/hooks";
 import { CreateStateOfApplicabilityDialog } from "./dialogs/CreateStateOfApplicabilityDialog";
-import { PermissionsContext } from "/providers/PermissionsContext";
+import { useEffect } from "react";
-import { use, useEffect } from "react";
 import { useOrganizationId } from "/hooks/useOrganizationId";
 import { formatDate } from "@probo/helpers";
 import { useParams } from "react-router";
 import { SnapshotBanner } from "/components/SnapshotBanner";
+import type { StateOfApplicabilityListQuery } from "/__generated__/core/StateOfApplicabilityListQuery.graphql";
 
 type StateOfApplicability = NodeOf<
     StateOfApplicabilityGraphPaginatedFragment$data["statesOfApplicability"]
@@ -41,20 +49,32 @@ export default function StatesOfApplicabilityPage({
     queryRef: PreloadedQuery<StateOfApplicabilityGraphPaginatedQuery>;
 }) {
     const { __ } = useTranslate();
-    const { isAuthorized } = use(PermissionsContext);
     const { snapshotId } = useParams<{ snapshotId?: string }>();
     const isSnapshotMode = Boolean(snapshotId);
-    const {
-        statesOfApplicability,
-        connectionId,
-        hasNext,
-        loadNext,
-        isLoadingNext,
-        refetch,
-    } = useStateOfApplicabilityQuery(queryRef);
 
     usePageTitle(__("States of Applicability"));
 
+    const { organization } =
+        usePreloadedQuery<StateOfApplicabilityGraphPaginatedQuery>(
+            paginatedStateOfApplicabilityQuery,
+            queryRef,
+        );
+
+    if (organization.__typename !== "Organization") {
+        throw new Error("Organization not found");
+    }
+
+    const {
+        data: { statesOfApplicability },
+        loadNext,
+        hasNext,
+        refetch,
+        isLoadingNext,
+    } = usePaginationFragment<
+        StateOfApplicabilityListQuery,
+        StateOfApplicabilityGraphPaginatedFragment$key
+    >(paginatedStateOfApplicabilityFragment, organization);
+
     // Refetch with snapshot filter when in snapshot mode
     useEffect(() => {
         if (snapshotId) {
@@ -67,7 +87,9 @@ export default function StatesOfApplicabilityPage({
 
     const hasAnyAction =
         !isSnapshotMode &&
-        isAuthorized("StateOfApplicability", "deleteStateOfApplicability");
+        statesOfApplicability.edges
+            .map((edge) => edge.node)
+            .some(({ canDelete }) => canDelete);
 
     return (
         <div className="space-y-6">
@@ -79,12 +101,9 @@ export default function StatesOfApplicabilityPage({
                 )}
             >
                 {!isSnapshotMode &&
-                    isAuthorized(
+                    organization.canCreateStateOfApplicability && (
-                        "Organization",
-                        "createStateOfApplicability",
-                    ) && (
                         <CreateStateOfApplicabilityDialog
-                            connectionId={connectionId}
+                            connectionId={statesOfApplicability.__id}
                         >
                             <Button icon={IconPlusLarge}>
                                 {__("Add state of applicability")}
@@ -93,7 +112,7 @@ export default function StatesOfApplicabilityPage({
                     )}
             </PageHeader>
 
-            {statesOfApplicability && statesOfApplicability.length > 0 ? (
+            {statesOfApplicability && statesOfApplicability.edges.length > 0 ? (
                 <Card>
                     <Table>
                         <Thead>
@@ -105,11 +124,11 @@ export default function StatesOfApplicabilityPage({
                             </Tr>
                         </Thead>
                         <Tbody>
-                            {statesOfApplicability.map((soa) => (
+                            {statesOfApplicability.edges.map((edge) => (
                                 <StateOfApplicabilityRow
-                                    key={soa.id}
+                                    key={edge.node.id}
-                                    stateOfApplicability={soa}
+                                    stateOfApplicability={edge.node}
-                                    connectionId={connectionId}
+                                    connectionId={statesOfApplicability.__id}
                                     hasAnyAction={hasAnyAction}
                                 />
                             ))}
@@ -164,7 +183,6 @@ function StateOfApplicabilityRow({
         stateOfApplicability,
         connectionId,
     );
-    const { isAuthorized } = use(PermissionsContext);
 
     const detailUrl = snapshotId
         ? `/organizations/${organizationId}/snapshots/${snapshotId}/states-of-applicability/${stateOfApplicability.id}`
@@ -182,10 +200,7 @@ function StateOfApplicabilityRow({
             {hasAnyAction && (
                 <Td noLink width={50} className="text-end">
                     <ActionDropdown>
-                        {isAuthorized(
+                        {stateOfApplicability.canDelete && (
-                            "StateOfApplicability",
-                            "deleteStateOfApplicability",
-                        ) && (
                             <DropdownItem
                                 icon={IconTrashCan}
                                 variant="danger"

apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx

@@ -27,8 +27,6 @@ import {
     type EditControlDialogRef,
 } from "../dialogs/EditControlDialog";
 import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
-import { use } from "react";
-import { PermissionsContext } from "/providers/PermissionsContext";
 
 export const controlsFragment = graphql`
     fragment StateOfApplicabilityControlsTabFragment on StateOfApplicability
@@ -37,6 +35,14 @@ export const controlsFragment = graphql`
         controlsInfo: controls(first: 0) {
             totalCount
         }
+
+        canCreateStateOfApplicabilityControlMapping: permission(
+            action: "core:state-of-applicability:control-mapping:create"
+        )
+        canDeleteStateOfApplicabilityControlMapping: permission(
+            action: "core:state-of-applicability:control-mapping:delete"
+        )
+
         availableControls {
             controlId
             sectionTitle
@@ -84,7 +90,6 @@ export default function StateOfApplicabilityControlsTab({
     const organizationId = useOrganizationId();
     const manageDialogRef = useRef<LinkControlDialogRef>(null);
     const editDialogRef = useRef<EditControlDialogRef>(null);
-    const { isAuthorized } = use(PermissionsContext);
 
     const linkedControls = useMemo(
         () =>
@@ -103,11 +108,9 @@ export default function StateOfApplicabilityControlsTab({
     );
 
     const canLink =
-        !isSnapshotMode &&
+        !isSnapshotMode && data.canCreateStateOfApplicabilityControlMapping;
-        isAuthorized("StateOfApplicability", "updateStateOfApplicability");
     const canUnlink =
-        !isSnapshotMode &&
+        !isSnapshotMode && data.canDeleteStateOfApplicabilityControlMapping;
-        isAuthorized("StateOfApplicability", "updateStateOfApplicability");
 
     const handleOpenManageDialog = () => {
         manageDialogRef.current?.open(data.id, () => {

apps/console/src/providers/NewPermissionsContext.tsx

@@ -1,5 +0,0 @@
-import { createContext } from "react";
-
-export type PermissionsContextType = Record<string, boolean>;
-
-export const PermissionsContext = createContext<PermissionsContextType>({});

apps/console/src/providers/NewPermissionsProvider.tsx

@@ -1,72 +0,0 @@
-import { useEffect, type PropsWithChildren } from "react";
-import { PermissionsContext } from "./NewPermissionsContext";
-import {
-  usePreloadedQuery,
-  useQueryLoader,
-  type PreloadedQuery,
-} from "react-relay";
-import type { GraphQLTaggedNode, OperationType } from "relay-runtime";
-import { useOrganizationId } from "/hooks/useOrganizationId";
-
-type PermissionsQueryType = OperationType & {
-  response: { viewer: Record<string, boolean> };
-};
-
-type PermissionsProviderLoaderProps = PropsWithChildren<{
-  query: GraphQLTaggedNode;
-}>;
-
-export function PermissionsProviderLoader<T extends PermissionsQueryType>(
-  props: PermissionsProviderLoaderProps,
-) {
-  const { children, query } = props;
-
-  const organizationId = useOrganizationId();
-  const [queryRef, loadQuery] = useQueryLoader<T>(query);
-
-  useEffect(() => {
-    loadQuery({
-      organizationId,
-    });
-  }, [loadQuery, organizationId]);
-
-  if (!queryRef) {
-    // While permissions are loading, consider there are no permissions
-    return <PermissionsContext value={{}}>{children}</PermissionsContext>;
-  }
-
-  return (
-    <PermissionsProvider query={query} queryRef={queryRef}>
-      {children}
-    </PermissionsProvider>
-  );
-}
-
-type PermissionsProviderProps<T extends PermissionsQueryType> =
-  PermissionsProviderLoaderProps & {
-    queryRef: PreloadedQuery<T>;
-  };
-
-function PermissionsProvider<T extends PermissionsQueryType>(
-  props: PermissionsProviderProps<T>,
-) {
-  const { children, query, queryRef } = props;
-
-  const { viewer: permissions } = usePreloadedQuery<T>(query, queryRef);
-
-  const handler = {
-    get(target: Record<string, boolean>, prop: string) {
-      if (!(prop in target)) {
-        throw new Error(`Field ${prop} is not defined in IAM viewer node`);
-      }
-
-      return Reflect.get(target, prop);
-    },
-  };
-
-  return (
-    <PermissionsContext value={new Proxy(permissions, handler)}>
-      {children}
-    </PermissionsContext>
-  );
-}

apps/console/src/providers/PermissionsContext.tsx

@@ -1,17 +0,0 @@
-import { createContext } from "react";
-import { Role } from "@probo/helpers";
-
-export type PermissionsResponse = {
-  permissions: Record<string, Record<string, boolean>>;
-  role: Role;
-};
-
-type PermissionsContextType = {
-  isAuthorized: (entity: string, action: string) => boolean;
-} & PermissionsResponse;
-
-export const PermissionsContext = createContext<PermissionsContextType>({
-  permissions: {},
-  role: Role.VIEWER,
-  isAuthorized: () => false,
-});

apps/console/src/providers/PermissionsProvider.tsx

@@ -1,41 +0,0 @@
-import { type PropsWithChildren } from "react";
-import { PermissionsContext } from "./PermissionsContext";
-import { Role } from "@probo/helpers";
-
-export function PermissionsProvider(props: PropsWithChildren) {
-  const { children } = props;
-
-  // const organizationId = useOrganizationId();
-
-  // const { data } = useSuspenseQuery<PermissionsResponse>({
-  //   queryKey: ["permissions", organizationId],
-  //   queryFn: async () => {
-  //     const response = await fetch(`/authz/${organizationId}/permissions`, { credentials: "include" });
-  //     if (!response.ok) {
-  //       throw new Error("Failed to fetch permissions");
-  //     }
-  //     return response.json() as Promise<PermissionsResponse>;
-  //   },
-  // });
-
-  // @ts-expect-error wip refactor
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  const isAuthorized = (entity: string, action: string) => {
-    // return data.permissions[entity]?.[action] ?? false;
-    return true;
-  };
-
-  return (
-    <PermissionsContext
-      value={{ permissions: {}, role: Role.OWNER, isAuthorized }}
-    >
-      {children}
-    </PermissionsContext>
-  );
-
-  // return (
-  //   <PermissionsContext value={{ ...data, isAuthorized }}>
-  //     {children}
-  //   </PermissionsContext>
-  // );
-}

apps/console/src/routes.tsx

@@ -2,6 +2,7 @@ import {
   createBrowserRouter,
   Navigate,
   redirect,
+  useOutletContext,
   useRouteError,
 } from "react-router";
 import { CenteredLayout, CenteredLayoutSkeleton } from "@probo/ui";
@@ -29,8 +30,6 @@ import { statesOfApplicabilityRoutes } from "./routes/statesOfApplicabilityRoute
 import { lazy } from "@probo/react-lazy";
 import { routeFromAppRoute, type AppRoute } from "@probo/routes";
 import { Role } from "@probo/helpers";
-import { PermissionsContext } from "./providers/PermissionsContext";
-import { use } from "react";
 import {
   ForbiddenError,
   UnAuthenticatedError,
@@ -98,13 +97,13 @@ const routes = [
       {
         index: true,
         Component: lazy(
-          () => import("./pages/iam/memberships/MembershipsPageLoader")
+          () => import("./pages/iam/memberships/MembershipsPageLoader"),
         ),
       },
       {
         path: "organizations/new",
         Component: lazy(
-          () => import("./pages/iam/organizations/NewOrganizationPage")
+          () => import("./pages/iam/organizations/NewOrganizationPage"),
         ),
       },
       {
@@ -121,7 +120,7 @@ const routes = [
     path: "/organizations/:organizationId/employee",
     Fallback: () => "fallback employee...",
     Component: lazy(
-      () => import("./pages/iam/memberships/MembershipLayoutLoader")
+      () => import("./pages/iam/memberships/MembershipLayoutLoader"),
     ),
     ErrorBoundary: ErrorBoundary,
     children: [
@@ -130,7 +129,7 @@ const routes = [
         // Component: () => "hello world",
         Component: lazy(
           () =>
-            import("./pages/organizations/employee/EmployeeDocumentsPageLoader")
+            import("./pages/organizations/employee/EmployeeDocumentsPageLoader"),
         ),
       },
       {
@@ -138,7 +137,7 @@ const routes = [
         ErrorBoundary: ErrorBoundary,
         Component: lazy(
           () =>
-            import("./pages/organizations/employee/EmployeeDocumentSignaturePageLoader")
+            import("./pages/organizations/employee/EmployeeDocumentSignaturePageLoader"),
         ),
       },
     ],
@@ -146,14 +145,14 @@ const routes = [
   {
     path: "/organizations/:organizationId",
     Component: lazy(
-      () => import("./pages/iam/memberships/MembershipLayoutLoader")
+      () => import("./pages/iam/memberships/MembershipLayoutLoader"),
     ),
     ErrorBoundary: ErrorBoundary,
     children: [
       {
         path: "",
         Component: () => {
-          const { role } = use(PermissionsContext);
+          const role = useOutletContext<Role>();
           switch (role) {
             case Role.EMPLOYEE:
               return <Navigate to="employee" />;
@@ -168,7 +167,7 @@ const routes = [
         path: "settings",
         Fallback: PageSkeleton,
         Component: lazy(
-          () => import("./pages/iam/organizations/settings/SettingsLayout")
+          () => import("./pages/iam/organizations/settings/SettingsLayout"),
         ),
         children: [
           {
@@ -181,28 +180,28 @@ const routes = [
             path: "general",
             Component: lazy(
               () =>
-                import("./pages/iam/organizations/settings/GeneralSettingsPageLoader")
+                import("./pages/iam/organizations/settings/GeneralSettingsPageLoader"),
             ),
           },
           {
             path: "members",
             Component: lazy(
               () =>
-                import("./pages/iam/organizations/settings/MembersPageLoader")
+                import("./pages/iam/organizations/settings/MembersPageLoader"),
             ),
           },
           {
             path: "domain",
             Component: lazy(
               () =>
-                import("./pages/organizations/settings/DomainSettingsPageLoader")
+                import("./pages/organizations/settings/DomainSettingsPageLoader"),
             ),
           },
           {
             path: "saml-sso",
             Component: lazy(
               () =>
-                import("./pages/iam/organizations/settings/SAMLSettingsPageLoader")
+                import("./pages/iam/organizations/settings/SAMLSettingsPageLoader"),
             ),
           },
         ],

pkg/server/api/console/v1/schema.graphql

@@ -48,9 +48,13 @@ enum MeasureState
     IN_PROGRESS
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureStateInProgress")
     NOT_APPLICABLE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureStateNotApplicable")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeasureStateNotApplicable"
+        )
     IMPLEMENTED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureStateImplemented")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeasureStateImplemented"
+        )
 }
 
 enum TaskState @goModel(model: "go.probo.inc/probo/pkg/coredata.TaskState") {
@@ -67,18 +71,23 @@ enum EvidenceState
 }
 
 enum PeopleKind @goModel(model: "go.probo.inc/probo/pkg/coredata.PeopleKind") {
-  EMPLOYEE @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindEmployee")
+    EMPLOYEE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindEmployee")
     CONTRACTOR
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindContractor")
     SERVICE_ACCOUNT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindServiceAccount")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.PeopleKindServiceAccount"
+        )
 }
 
 enum DocumentStatus
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentStatus") {
     DRAFT @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentStatusDraft")
     PUBLISHED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentStatusPublished")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DocumentStatusPublished"
+        )
 }
 
 enum EvidenceType
@@ -93,9 +102,12 @@ enum RiskTreatment
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentMitigated")
     ACCEPTED
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentAccepted")
-  AVOIDED @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentAvoided")
+    AVOIDED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentAvoided")
     TRANSFERRED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentTransferred")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentTransferred"
+        )
 }
 
 enum AuditState @goModel(model: "go.probo.inc/probo/pkg/coredata.AuditState") {
@@ -105,14 +117,18 @@ enum AuditState @goModel(model: "go.probo.inc/probo/pkg/coredata.AuditState") {
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateInProgress")
     COMPLETED
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateCompleted")
-  REJECTED @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateRejected")
+    REJECTED
-  OUTDATED @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateOutdated")
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateRejected")
+    OUTDATED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateOutdated")
 }
 
 enum TrustCenterVisibility
     @goModel(model: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibility") {
     NONE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibilityNone")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibilityNone"
+        )
     PRIVATE
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibilityPrivate"
@@ -147,13 +163,18 @@ enum TrustCenterDocumentAccessStatus
 
 enum NonconformityStatus
     @goModel(model: "go.probo.inc/probo/pkg/coredata.NonconformityStatus") {
-  OPEN @goEnum(value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusOpen")
+    OPEN
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusOpen"
+        )
     IN_PROGRESS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusInProgress"
         )
     CLOSED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusClosed")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusClosed"
+        )
 }
 
 enum ObligationStatus
@@ -167,14 +188,18 @@ enum ObligationStatus
             value: "go.probo.inc/probo/pkg/coredata.ObligationStatusPartiallyCompliant"
         )
     COMPLIANT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant"
+        )
 }
 
 enum ObligationType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.ObligationType") {
     LEGAL @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeLegal")
     CONTRACTUAL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual"
+        )
 }
 
 enum ContinualImprovementStatus
@@ -216,9 +241,13 @@ enum ContinualImprovementPriority
 enum RightsRequestType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.RightsRequestType") {
     ACCESS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeAccess")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeAccess"
+        )
     DELETION
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeDeletion")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeDeletion"
+        )
     PORTABILITY
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypePortability"
@@ -227,12 +256,14 @@ enum RightsRequestType
 
 enum RightsRequestState
     @goModel(model: "go.probo.inc/probo/pkg/coredata.RightsRequestState") {
-  TODO @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateTodo")
+    TODO
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateTodo")
     IN_PROGRESS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateInProgress"
         )
-  DONE @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateDone")
+    DONE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateDone")
 }
 
 enum ProcessingActivitySpecialOrCriminalDatum
@@ -375,9 +406,13 @@ enum ProcessingActivityRole
 enum PeopleOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.PeopleOrderField") {
     FULL_NAME
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldFullName")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldFullName"
+        )
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldCreatedAt"
+        )
     KIND @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldKind")
 }
 
@@ -385,9 +420,13 @@ enum VendorOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorOrderField") {
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldName")
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldCreatedAt"
+        )
     UPDATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldUpdatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldUpdatedAt"
+        )
 }
 
 enum FrameworkOrderField
@@ -401,7 +440,9 @@ enum FrameworkOrderField
 enum ControlOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.ControlOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ControlOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlOrderFieldCreatedAt"
+        )
     SECTION_TITLE
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.ControlOrderFieldSectionTitle"
@@ -411,7 +452,9 @@ enum ControlOrderField
 enum MeasureOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.MeasureOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeasureOrderFieldCreatedAt"
+        )
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureOrderFieldName")
 }
 
@@ -423,7 +466,9 @@ enum TaskOrderField
 enum DocumentOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentOrderField") {
     TITLE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentOrderFieldTitle")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DocumentOrderFieldTitle"
+        )
     CREATED_AT
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.DocumentOrderFieldCreatedAt"
@@ -439,20 +484,28 @@ enum MeetingOrderField
     DATE @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldDate")
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldName")
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldCreatedAt"
+        )
 }
 
 enum RiskOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.RiskOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldCreatedAt"
+        )
     UPDATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldUpdatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldUpdatedAt"
+        )
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldName")
     CATEGORY
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldCategory")
     TREATMENT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldTreatment")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldTreatment"
+        )
     INHERENT_RISK_SCORE
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldInherentRiskScore"
@@ -517,7 +570,9 @@ enum VendorServiceOrderField
 enum OrganizationOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.OrganizationOrderField") {
     NAME
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.OrganizationOrderFieldName")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.OrganizationOrderFieldName"
+        )
     CREATED_AT
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.OrganizationOrderFieldCreatedAt"
@@ -532,23 +587,29 @@ enum DataSensitivity
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DataSensitivity") {
     NONE @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityNone")
     LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityLow")
-  MEDIUM @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityMedium")
+    MEDIUM
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityMedium")
     HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityHigh")
     CRITICAL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityCritical")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataSensitivityCritical"
+        )
 }
 
 enum BusinessImpact
     @goModel(model: "go.probo.inc/probo/pkg/coredata.BusinessImpact") {
     LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactLow")
-  MEDIUM @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactMedium")
+    MEDIUM
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactMedium")
     HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactHigh")
     CRITICAL
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactCritical")
 }
 
 enum DocumentVersionOrderField
-  @goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrderField") {
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrderField"
+    ) {
     CREATED_AT
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrderFieldCreatedAt"
@@ -811,7 +872,9 @@ enum CountryCode
 enum VendorCategory
     @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorCategory") {
     ANALYTICS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryAnalytics")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryAnalytics"
+        )
     CLOUD_MONITORING
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCloudMonitoring"
@@ -841,7 +904,9 @@ enum VendorCategory
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEmployeeManagement"
         )
     ENGINEERING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEngineering")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEngineering"
+        )
     FINANCE
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryFinance")
     IDENTITY_PROVIDER
@@ -850,7 +915,9 @@ enum VendorCategory
         )
     IT @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryIT")
     MARKETING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryMarketing")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryMarketing"
+        )
     OFFICE_OPERATIONS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryOfficeOperations"
@@ -869,7 +936,9 @@ enum VendorCategory
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryProfessionalServices"
         )
     RECRUITING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryRecruiting")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryRecruiting"
+        )
     SALES @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySales")
     SECURITY
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySecurity")
@@ -916,14 +985,19 @@ enum AssetType @goModel(model: "go.probo.inc/probo/pkg/coredata.AssetType") {
 enum AssetOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.AssetOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldCreatedAt")
+        @goEnum(
-  AMOUNT @goEnum(value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldAmount")
+            value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldCreatedAt"
+        )
+    AMOUNT
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldAmount")
 }
 
 enum DatumOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DatumOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DatumOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DatumOrderFieldCreatedAt"
+        )
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.DatumOrderFieldName")
     DATA_CLASSIFICATION
         @goEnum(
@@ -934,15 +1008,21 @@ enum DatumOrderField
 enum DataClassification
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DataClassification") {
     PUBLIC
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataClassificationPublic")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataClassificationPublic"
+        )
     INTERNAL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataClassificationInternal")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataClassificationInternal"
+        )
     CONFIDENTIAL
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.DataClassificationConfidential"
         )
     SECRET
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataClassificationSecret")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataClassificationSecret"
+        )
 }
 
 enum ControlStatus
@@ -956,11 +1036,17 @@ enum ControlStatus
 enum AuditOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.AuditOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldCreatedAt"
+        )
     VALID_FROM
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidFrom")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidFrom"
+        )
     VALID_UNTIL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidUntil")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidUntil"
+        )
     STATE @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldState")
 }
 
@@ -1003,7 +1089,9 @@ enum ObligationOrderField
             value: "go.probo.inc/probo/pkg/coredata.ObligationOrderFieldDueDate"
         )
     STATUS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationOrderFieldStatus")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ObligationOrderFieldStatus"
+        )
 }
 
 enum ContinualImprovementOrderField
@@ -1129,7 +1217,9 @@ enum TrustCenterReferenceOrderField
 }
 
 enum TrustCenterFileOrderField
-  @goModel(model: "go.probo.inc/probo/pkg/coredata.TrustCenterFileOrderField") {
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.TrustCenterFileOrderField"
+    ) {
     NAME
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrustCenterFileOrderFieldName"
@@ -1147,7 +1237,8 @@ enum TrustCenterFileOrderField
 enum SnapshotsType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.SnapshotsType") {
     RISKS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeRisks")
-  VENDORS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeVendors")
+    VENDORS
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeVendors")
     ASSETS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeAssets")
     DATA @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeData")
     NONCONFORMITIES
@@ -1155,7 +1246,9 @@ enum SnapshotsType
             value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeNonconformities"
         )
     OBLIGATIONS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeObligations")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeObligations"
+        )
     CONTINUAL_IMPROVEMENTS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeContinualImprovements"
@@ -1176,8 +1269,10 @@ enum SnapshotOrderField
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldCreatedAt"
         )
-  NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldName")
+    NAME
-  TYPE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldType")
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldName")
+    TYPE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldType")
 }
 
 # Input Types
@@ -1770,7 +1865,8 @@ type Vendor implements Node {
 
     businessAssociateAgreement: VendorBusinessAssociateAgreement
         @goField(forceResolver: true)
-  dataPrivacyAgreement: VendorDataPrivacyAgreement @goField(forceResolver: true)
+    dataPrivacyAgreement: VendorDataPrivacyAgreement
+        @goField(forceResolver: true)
 
     contacts(
         first: Int
@@ -2148,6 +2244,9 @@ type StateOfApplicability implements Node {
     snapshotId: ID
     organization: Organization @goField(forceResolver: true)
     owner: People! @goField(forceResolver: true)
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+
     controls(
         first: Int
         after: CursorKey
@@ -2320,6 +2419,8 @@ type RightsRequest implements Node {
     actionTaken: String
     createdAt: Datetime!
     updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
 }
 
 type ProcessingActivity implements Node {
@@ -4958,7 +5059,9 @@ type DeleteAssetPayload {
 }
 
 type Datum implements Node
-  @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.Datum") {
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.Datum"
+    ) {
     id: ID!
     snapshotId: ID
     name: String!

pkg/server/api/console/v1/schema/schema.go

@@ -1295,6 +1295,7 @@ type ComplexityRoot struct {
 		Details      func(childComplexity int) int
 		ID           func(childComplexity int) int
 		Organization func(childComplexity int) int
+		Permission   func(childComplexity int, action string) int
 		RequestState func(childComplexity int) int
 		RequestType  func(childComplexity int) int
 		UpdatedAt    func(childComplexity int) int
@@ -1430,6 +1431,7 @@ type ComplexityRoot struct {
 		Name              func(childComplexity int) int
 		Organization      func(childComplexity int) int
 		Owner             func(childComplexity int) int
+		Permission        func(childComplexity int, action string) int
 		SnapshotID        func(childComplexity int) int
 		SourceID          func(childComplexity int) int
 		UpdatedAt         func(childComplexity int) int
@@ -2312,6 +2314,8 @@ type ReportResolver interface {
 }
 type RightsRequestResolver interface {
 	Organization(ctx context.Context, obj *types.RightsRequest) (*types.Organization, error)
+
+	Permission(ctx context.Context, obj *types.RightsRequest, action string) (bool, error)
 }
 type RightsRequestConnectionResolver interface {
 	TotalCount(ctx context.Context, obj *types.RightsRequestConnection) (int, error)
@@ -2346,6 +2350,7 @@ type SnapshotConnectionResolver interface {
 type StateOfApplicabilityResolver interface {
 	Organization(ctx context.Context, obj *types.StateOfApplicability) (*types.Organization, error)
 	Owner(ctx context.Context, obj *types.StateOfApplicability) (*types.People, error)
+	Permission(ctx context.Context, obj *types.StateOfApplicability, action string) (bool, error)
 	Controls(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error)
 	AvailableControls(ctx context.Context, obj *types.StateOfApplicability) ([]*types.AvailableStateOfApplicabilityControl, error)
 }
@@ -7722,6 +7727,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.RightsRequest.Organization(childComplexity), true
+	case "RightsRequest.permission":
+		if e.complexity.RightsRequest.Permission == nil {
+			break
+		}
+
+		args, err := ec.field_RightsRequest_permission_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.RightsRequest.Permission(childComplexity, args["action"].(string)), true
 	case "RightsRequest.requestState":
 		if e.complexity.RightsRequest.RequestState == nil {
 			break
@@ -8271,6 +8287,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.StateOfApplicability.Owner(childComplexity), true
+	case "StateOfApplicability.permission":
+		if e.complexity.StateOfApplicability.Permission == nil {
+			break
+		}
+
+		args, err := ec.field_StateOfApplicability_permission_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.StateOfApplicability.Permission(childComplexity, args["action"].(string)), true
 	case "StateOfApplicability.snapshotId":
 		if e.complexity.StateOfApplicability.SnapshotID == nil {
 			break
@@ -10418,9 +10445,13 @@ enum MeasureState
     IN_PROGRESS
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureStateInProgress")
     NOT_APPLICABLE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureStateNotApplicable")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeasureStateNotApplicable"
+        )
     IMPLEMENTED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureStateImplemented")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeasureStateImplemented"
+        )
 }
 
 enum TaskState @goModel(model: "go.probo.inc/probo/pkg/coredata.TaskState") {
@@ -10437,18 +10468,23 @@ enum EvidenceState
 }
 
 enum PeopleKind @goModel(model: "go.probo.inc/probo/pkg/coredata.PeopleKind") {
-  EMPLOYEE @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindEmployee")
+    EMPLOYEE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindEmployee")
     CONTRACTOR
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindContractor")
     SERVICE_ACCOUNT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleKindServiceAccount")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.PeopleKindServiceAccount"
+        )
 }
 
 enum DocumentStatus
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentStatus") {
     DRAFT @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentStatusDraft")
     PUBLISHED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentStatusPublished")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DocumentStatusPublished"
+        )
 }
 
 enum EvidenceType
@@ -10463,9 +10499,12 @@ enum RiskTreatment
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentMitigated")
     ACCEPTED
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentAccepted")
-  AVOIDED @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentAvoided")
+    AVOIDED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentAvoided")
     TRANSFERRED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentTransferred")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskTreatmentTransferred"
+        )
 }
 
 enum AuditState @goModel(model: "go.probo.inc/probo/pkg/coredata.AuditState") {
@@ -10475,14 +10514,18 @@ enum AuditState @goModel(model: "go.probo.inc/probo/pkg/coredata.AuditState") {
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateInProgress")
     COMPLETED
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateCompleted")
-  REJECTED @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateRejected")
+    REJECTED
-  OUTDATED @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateOutdated")
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateRejected")
+    OUTDATED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditStateOutdated")
 }
 
 enum TrustCenterVisibility
     @goModel(model: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibility") {
     NONE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibilityNone")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibilityNone"
+        )
     PRIVATE
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrustCenterVisibilityPrivate"
@@ -10517,13 +10560,18 @@ enum TrustCenterDocumentAccessStatus
 
 enum NonconformityStatus
     @goModel(model: "go.probo.inc/probo/pkg/coredata.NonconformityStatus") {
-  OPEN @goEnum(value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusOpen")
+    OPEN
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusOpen"
+        )
     IN_PROGRESS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusInProgress"
         )
     CLOSED
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusClosed")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.NonconformityStatusClosed"
+        )
 }
 
 enum ObligationStatus
@@ -10537,14 +10585,18 @@ enum ObligationStatus
             value: "go.probo.inc/probo/pkg/coredata.ObligationStatusPartiallyCompliant"
         )
     COMPLIANT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant"
+        )
 }
 
 enum ObligationType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.ObligationType") {
     LEGAL @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeLegal")
     CONTRACTUAL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual"
+        )
 }
 
 enum ContinualImprovementStatus
@@ -10586,9 +10638,13 @@ enum ContinualImprovementPriority
 enum RightsRequestType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.RightsRequestType") {
     ACCESS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeAccess")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeAccess"
+        )
     DELETION
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeDeletion")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypeDeletion"
+        )
     PORTABILITY
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.RightsRequestTypePortability"
@@ -10597,12 +10653,14 @@ enum RightsRequestType
 
 enum RightsRequestState
     @goModel(model: "go.probo.inc/probo/pkg/coredata.RightsRequestState") {
-  TODO @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateTodo")
+    TODO
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateTodo")
     IN_PROGRESS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateInProgress"
         )
-  DONE @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateDone")
+    DONE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.RightsRequestStateDone")
 }
 
 enum ProcessingActivitySpecialOrCriminalDatum
@@ -10745,9 +10803,13 @@ enum ProcessingActivityRole
 enum PeopleOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.PeopleOrderField") {
     FULL_NAME
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldFullName")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldFullName"
+        )
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldCreatedAt"
+        )
     KIND @goEnum(value: "go.probo.inc/probo/pkg/coredata.PeopleOrderFieldKind")
 }
 
@@ -10755,9 +10817,13 @@ enum VendorOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorOrderField") {
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldName")
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldCreatedAt"
+        )
     UPDATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldUpdatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldUpdatedAt"
+        )
 }
 
 enum FrameworkOrderField
@@ -10771,7 +10837,9 @@ enum FrameworkOrderField
 enum ControlOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.ControlOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ControlOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlOrderFieldCreatedAt"
+        )
     SECTION_TITLE
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.ControlOrderFieldSectionTitle"
@@ -10781,7 +10849,9 @@ enum ControlOrderField
 enum MeasureOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.MeasureOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeasureOrderFieldCreatedAt"
+        )
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeasureOrderFieldName")
 }
 
@@ -10793,7 +10863,9 @@ enum TaskOrderField
 enum DocumentOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentOrderField") {
     TITLE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DocumentOrderFieldTitle")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DocumentOrderFieldTitle"
+        )
     CREATED_AT
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.DocumentOrderFieldCreatedAt"
@@ -10809,20 +10881,28 @@ enum MeetingOrderField
     DATE @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldDate")
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldName")
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.MeetingOrderFieldCreatedAt"
+        )
 }
 
 enum RiskOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.RiskOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldCreatedAt"
+        )
     UPDATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldUpdatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldUpdatedAt"
+        )
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldName")
     CATEGORY
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldCategory")
     TREATMENT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldTreatment")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldTreatment"
+        )
     INHERENT_RISK_SCORE
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.RiskOrderFieldInherentRiskScore"
@@ -10887,7 +10967,9 @@ enum VendorServiceOrderField
 enum OrganizationOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.OrganizationOrderField") {
     NAME
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.OrganizationOrderFieldName")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.OrganizationOrderFieldName"
+        )
     CREATED_AT
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.OrganizationOrderFieldCreatedAt"
@@ -10902,23 +10984,29 @@ enum DataSensitivity
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DataSensitivity") {
     NONE @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityNone")
     LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityLow")
-  MEDIUM @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityMedium")
+    MEDIUM
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityMedium")
     HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityHigh")
     CRITICAL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityCritical")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataSensitivityCritical"
+        )
 }
 
 enum BusinessImpact
     @goModel(model: "go.probo.inc/probo/pkg/coredata.BusinessImpact") {
     LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactLow")
-  MEDIUM @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactMedium")
+    MEDIUM
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactMedium")
     HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactHigh")
     CRITICAL
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactCritical")
 }
 
 enum DocumentVersionOrderField
-  @goModel(model: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrderField") {
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrderField"
+    ) {
     CREATED_AT
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.DocumentVersionOrderFieldCreatedAt"
@@ -11181,7 +11269,9 @@ enum CountryCode
 enum VendorCategory
     @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorCategory") {
     ANALYTICS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryAnalytics")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryAnalytics"
+        )
     CLOUD_MONITORING
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCloudMonitoring"
@@ -11211,7 +11301,9 @@ enum VendorCategory
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEmployeeManagement"
         )
     ENGINEERING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEngineering")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEngineering"
+        )
     FINANCE
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryFinance")
     IDENTITY_PROVIDER
@@ -11220,7 +11312,9 @@ enum VendorCategory
         )
     IT @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryIT")
     MARKETING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryMarketing")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryMarketing"
+        )
     OFFICE_OPERATIONS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryOfficeOperations"
@@ -11239,7 +11333,9 @@ enum VendorCategory
             value: "go.probo.inc/probo/pkg/coredata.VendorCategoryProfessionalServices"
         )
     RECRUITING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryRecruiting")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryRecruiting"
+        )
     SALES @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySales")
     SECURITY
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySecurity")
@@ -11286,14 +11382,19 @@ enum AssetType @goModel(model: "go.probo.inc/probo/pkg/coredata.AssetType") {
 enum AssetOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.AssetOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldCreatedAt")
+        @goEnum(
-  AMOUNT @goEnum(value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldAmount")
+            value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldCreatedAt"
+        )
+    AMOUNT
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.AssetOrderFieldAmount")
 }
 
 enum DatumOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DatumOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DatumOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DatumOrderFieldCreatedAt"
+        )
     NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.DatumOrderFieldName")
     DATA_CLASSIFICATION
         @goEnum(
@@ -11304,15 +11405,21 @@ enum DatumOrderField
 enum DataClassification
     @goModel(model: "go.probo.inc/probo/pkg/coredata.DataClassification") {
     PUBLIC
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataClassificationPublic")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataClassificationPublic"
+        )
     INTERNAL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataClassificationInternal")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataClassificationInternal"
+        )
     CONFIDENTIAL
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.DataClassificationConfidential"
         )
     SECRET
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataClassificationSecret")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataClassificationSecret"
+        )
 }
 
 enum ControlStatus
@@ -11326,11 +11433,17 @@ enum ControlStatus
 enum AuditOrderField
     @goModel(model: "go.probo.inc/probo/pkg/coredata.AuditOrderField") {
     CREATED_AT
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldCreatedAt")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldCreatedAt"
+        )
     VALID_FROM
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidFrom")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidFrom"
+        )
     VALID_UNTIL
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidUntil")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldValidUntil"
+        )
     STATE @goEnum(value: "go.probo.inc/probo/pkg/coredata.AuditOrderFieldState")
 }
 
@@ -11373,7 +11486,9 @@ enum ObligationOrderField
             value: "go.probo.inc/probo/pkg/coredata.ObligationOrderFieldDueDate"
         )
     STATUS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationOrderFieldStatus")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ObligationOrderFieldStatus"
+        )
 }
 
 enum ContinualImprovementOrderField
@@ -11499,7 +11614,9 @@ enum TrustCenterReferenceOrderField
 }
 
 enum TrustCenterFileOrderField
-  @goModel(model: "go.probo.inc/probo/pkg/coredata.TrustCenterFileOrderField") {
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.TrustCenterFileOrderField"
+    ) {
     NAME
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrustCenterFileOrderFieldName"
@@ -11517,7 +11634,8 @@ enum TrustCenterFileOrderField
 enum SnapshotsType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.SnapshotsType") {
     RISKS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeRisks")
-  VENDORS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeVendors")
+    VENDORS
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeVendors")
     ASSETS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeAssets")
     DATA @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeData")
     NONCONFORMITIES
@@ -11525,7 +11643,9 @@ enum SnapshotsType
             value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeNonconformities"
         )
     OBLIGATIONS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeObligations")
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeObligations"
+        )
     CONTINUAL_IMPROVEMENTS
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeContinualImprovements"
@@ -11546,8 +11666,10 @@ enum SnapshotOrderField
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldCreatedAt"
         )
-  NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldName")
+    NAME
-  TYPE @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldType")
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldName")
+    TYPE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldType")
 }
 
 # Input Types
@@ -12140,7 +12262,8 @@ type Vendor implements Node {
 
     businessAssociateAgreement: VendorBusinessAssociateAgreement
         @goField(forceResolver: true)
-  dataPrivacyAgreement: VendorDataPrivacyAgreement @goField(forceResolver: true)
+    dataPrivacyAgreement: VendorDataPrivacyAgreement
+        @goField(forceResolver: true)
 
     contacts(
         first: Int
@@ -12518,6 +12641,9 @@ type StateOfApplicability implements Node {
     snapshotId: ID
     organization: Organization @goField(forceResolver: true)
     owner: People! @goField(forceResolver: true)
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+
     controls(
         first: Int
         after: CursorKey
@@ -12690,6 +12816,8 @@ type RightsRequest implements Node {
     actionTaken: String
     createdAt: Datetime!
     updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
 }
 
 type ProcessingActivity implements Node {
@@ -15328,7 +15456,9 @@ type DeleteAssetPayload {
 }
 
 type Datum implements Node
-  @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.Datum") {
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.Datum"
+    ) {
     id: ID!
     snapshotId: ID
     name: String!
@@ -18736,6 +18866,17 @@ func (ec *executionContext) field_Report_permission_args(ctx context.Context, ra
 	return args, nil
 }
 
+func (ec *executionContext) field_RightsRequest_permission_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "action", ec.unmarshalNString2string)
+	if err != nil {
+		return nil, err
+	}
+	args["action"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Risk_controls_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -19010,6 +19151,17 @@ func (ec *executionContext) field_StateOfApplicability_controls_args(ctx context
 	return args, nil
 }
 
+func (ec *executionContext) field_StateOfApplicability_permission_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "action", ec.unmarshalNString2string)
+	if err != nil {
+		return nil, err
+	}
+	args["action"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Task_evidences_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -45756,6 +45908,47 @@ func (ec *executionContext) fieldContext_RightsRequest_updatedAt(_ context.Conte
 	return fc, nil
 }
 
+func (ec *executionContext) _RightsRequest_permission(ctx context.Context, field graphql.CollectedField, obj *types.RightsRequest) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_RightsRequest_permission,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.RightsRequest().Permission(ctx, obj, fc.Args["action"].(string))
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_RightsRequest_permission(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "RightsRequest",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_RightsRequest_permission_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _RightsRequestConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *types.RightsRequestConnection) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -45934,6 +46127,8 @@ func (ec *executionContext) fieldContext_RightsRequestEdge_node(_ context.Contex
 				return ec.fieldContext_RightsRequest_createdAt(ctx, field)
 			case "updatedAt":
 				return ec.fieldContext_RightsRequest_updatedAt(ctx, field)
+			case "permission":
+				return ec.fieldContext_RightsRequest_permission(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type RightsRequest", field.Name)
 		},
@@ -48627,6 +48822,47 @@ func (ec *executionContext) fieldContext_StateOfApplicability_owner(_ context.Co
 	return fc, nil
 }
 
+func (ec *executionContext) _StateOfApplicability_permission(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_permission,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.StateOfApplicability().Permission(ctx, obj, fc.Args["action"].(string))
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_permission(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_StateOfApplicability_permission_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _StateOfApplicability_controls(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -49017,6 +49253,8 @@ func (ec *executionContext) fieldContext_StateOfApplicabilityControl_stateOfAppl
 				return ec.fieldContext_StateOfApplicability_organization(ctx, field)
 			case "owner":
 				return ec.fieldContext_StateOfApplicability_owner(ctx, field)
+			case "permission":
+				return ec.fieldContext_StateOfApplicability_permission(ctx, field)
 			case "controls":
 				return ec.fieldContext_StateOfApplicability_controls(ctx, field)
 			case "availableControls":
@@ -49330,6 +49568,8 @@ func (ec *executionContext) fieldContext_StateOfApplicabilityEdge_node(_ context
 				return ec.fieldContext_StateOfApplicability_organization(ctx, field)
 			case "owner":
 				return ec.fieldContext_StateOfApplicability_owner(ctx, field)
+			case "permission":
+				return ec.fieldContext_StateOfApplicability_permission(ctx, field)
 			case "controls":
 				return ec.fieldContext_StateOfApplicability_controls(ctx, field)
 			case "availableControls":
@@ -54173,6 +54413,8 @@ func (ec *executionContext) fieldContext_UpdateRightsRequestPayload_rightsReques
 				return ec.fieldContext_RightsRequest_createdAt(ctx, field)
 			case "updatedAt":
 				return ec.fieldContext_RightsRequest_updatedAt(ctx, field)
+			case "permission":
+				return ec.fieldContext_RightsRequest_permission(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type RightsRequest", field.Name)
 		},
@@ -54291,6 +54533,8 @@ func (ec *executionContext) fieldContext_UpdateStateOfApplicabilityPayload_state
 				return ec.fieldContext_StateOfApplicability_organization(ctx, field)
 			case "owner":
 				return ec.fieldContext_StateOfApplicability_owner(ctx, field)
+			case "permission":
+				return ec.fieldContext_StateOfApplicability_permission(ctx, field)
 			case "controls":
 				return ec.fieldContext_StateOfApplicability_controls(ctx, field)
 			case "availableControls":
@@ -82384,6 +82628,42 @@ func (ec *executionContext) _RightsRequest(ctx context.Context, sel ast.Selectio
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
+		case "permission":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._RightsRequest_permission(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -83877,6 +84157,42 @@ func (ec *executionContext) _StateOfApplicability(ctx context.Context, sel ast.S
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "permission":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicability_permission(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "controls":
 			field := field

pkg/server/api/console/v1/types/types.go

@@ -1683,6 +1683,7 @@ type RightsRequest struct {
 	ActionTaken  *string                     `json:"actionTaken,omitempty"`
 	CreatedAt    time.Time                   `json:"createdAt"`
 	UpdatedAt    time.Time                   `json:"updatedAt"`
+	Permission   bool                        `json:"permission"`
 }
 
 func (RightsRequest) IsNode()             {}
@@ -1796,6 +1797,7 @@ type StateOfApplicability struct {
 	SnapshotID        *gid.GID                                `json:"snapshotId,omitempty"`
 	Organization      *Organization                           `json:"organization,omitempty"`
 	Owner             *People                                 `json:"owner"`
+	Permission        bool                                    `json:"permission"`
 	Controls          *ControlConnection                      `json:"controls"`
 	AvailableControls []*AvailableStateOfApplicabilityControl `json:"availableControls"`
 	CreatedAt         time.Time                               `json:"createdAt"`

pkg/server/api/console/v1/v1_resolver.go

@@ -314,7 +314,20 @@ func (r *continualImprovementConnectionResolver) TotalCount(ctx context.Context,
 
 // Organization is the resolver for the organization field.
 func (r *controlResolver) Organization(ctx context.Context, obj *types.Control) (*types.Organization, error) {
-	panic(fmt.Errorf("not implemented: Organization - organization"))
+	r.MustAuthorize(ctx, obj.ID, probo.ActionOrganizationGet)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	organization, err := prb.Organizations.Get(ctx, obj.Organization.ID)
+	if err != nil {
+		if errors.Is(err, coredata.ErrResourceNotFound) {
+			return nil, gqlutils.NotFound(err)
+		}
+
+		// TODO no panic use gqlutils.InternalError
+		panic(fmt.Errorf("cannot get organization: %w", err))
+	}
+	return types.NewOrganization(organization), nil
 }
 
 // Framework is the resolver for the framework field.
@@ -6275,6 +6288,11 @@ func (r *rightsRequestResolver) Organization(ctx context.Context, obj *types.Rig
 	return types.NewOrganization(organization), nil
 }
 
+// Permission is the resolver for the permission field.
+func (r *rightsRequestResolver) Permission(ctx context.Context, obj *types.RightsRequest, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // TotalCount is the resolver for the totalCount field.
 func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *types.RightsRequestConnection) (int, error) {
 	r.MustAuthorize(ctx, obj.ParentID, probo.ActionRightsRequesList)
@@ -6658,6 +6676,11 @@ func (r *stateOfApplicabilityResolver) Owner(ctx context.Context, obj *types.Sta
 	return types.NewPeople(people), nil
 }
 
+// Permission is the resolver for the permission field.
+func (r *stateOfApplicabilityResolver) Permission(ctx context.Context, obj *types.StateOfApplicability, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // Controls is the resolver for the controls field.
 func (r *stateOfApplicabilityResolver) Controls(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
 	r.MustAuthorize(ctx, obj.ID, probo.ActionControlList)