Session Roles and Scopes
Choose the right session role and scope when you mint a Meshes embed session.
Meshes embed behavior is driven by the role and scopes you send to POST /api/v1/sessions.
Roles
Current session roles:
memberadminowner
Use the lowest role that still supports the embedded workflow you want to expose.
Typical guidance:
member: lowest-privilege embed accessadmin: general operational embed accessowner: highest-privilege workspace embed access
Scopes
Some capabilities are intentionally controlled by explicit scopes rather than role alone.
Current scope:
events.payload:read
Grant this only when the embedded experience should be able to view event payloads.
Current payload rule
To view sensitive event payloads in embed, the session currently needs:
adminorowner- the
events.payload:readscope