Session Roles and Scopes
Choose the right session type, role, and scope when you mint a Meshes embed session.
Meshes embed behavior is driven by the session_type, role, and scopes you send to POST /api/v1/sessions.
Session types
workspace: current full embed surfaceresource: locks the session to oneresource+resource_idpairdashboard: read-only dashboard-only access
Roles
Current session roles:
memberadminowner
Use the lowest role that still supports the embedded workflow you want to expose.
Typical guidance:
member: lowest-privilege embed accessadmin: general operational embed accessowner: highest-privilege workspace embed access
Scopes
Some capabilities are intentionally controlled by explicit scopes rather than role alone.
Current scope:
events.payload:read
Grant this only when the embedded experience should be able to view event payloads.
Current payload rule
To view sensitive event payloads in embed, the session currently needs:
adminorowner- the
events.payload:readscope
This payload rule still applies to resource sessions. A resource session also has to be in scope for the event being viewed.