ER Diagram template · local export
RBAC Permission Model Mermaid Template
RBAC ER diagram linking users, teams, roles, permissions, and protected resources. Edit the code below, choose a publish preset, then export without signup, watermark, or cloud upload.
RBACpermissionssecurity
Paste or edit Mermaid code
Replace the sample below, or load another example.
Load example
Preparing the local renderer without uploading your diagram.Preparing editor…
Live previewSample preview · Clean Docs
Preparing local editor…
Render & export
Export controls activate after your diagram renders locally.
ERD
Mode
Default renderNative MermaidOptimized exportStyled download
Export style
Clean DocsGitHub READMETransparent DocsWarm Editorial✦ ProWhiteboard Sketch✦ ProAurora Noir✦ ProBlueprint✦ ProChampagne✦ ProEmerald Suite✦ ProEditorial✦ Pro
Scale
1x2x4x
Or exact width, e.g. 1200px wide
Output: White · comfortable padding
Size: calculated after render
Filename: mermaid-erd-white-2x.png
When to use the RBAC Permission Model template
A role-based access control schema: USERs join TEAMs through TEAM_MEMBER, receive ROLEs through USER_ROLE, and roles acquire PERMISSIONs via ROLE_PERMISSION. Each PERMISSION carries an action and scope, and RESOURCEs are protected by the permissions that reference them — the classic four-table RBAC shape with team support.
- •Modeling an authorization system before writing migrations, so the join-table structure is agreed up front.
- •Explaining to security reviewers exactly how a permission is granted, inherited, and scoped to resources.
- •Comparing your existing RBAC tables against this baseline when planning a refactor.
Template code
The full Mermaid source for this template — copy it into any Mermaid-compatible tool, or edit and export it in the editor above.
erDiagram
USER ||--o{ TEAM_MEMBER : joins
TEAM ||--o{ TEAM_MEMBER : includes
USER ||--o{ USER_ROLE : receives
ROLE ||--o{ USER_ROLE : assigned
ROLE ||--o{ ROLE_PERMISSION : grants
PERMISSION ||--o{ ROLE_PERMISSION : included
RESOURCE ||--o{ PERMISSION : protects
USER {
string id
string email
}
ROLE {
string id
string name
}
PERMISSION {
string action
string scope
}How to customize this template
- •Scope ROLE to a team or organization by adding a foreign key if your roles are not global.
- •Give RESOURCE a resource_type column, or split PERMISSION by resource class, if different objects authorize differently.
- •Add a grant/expiry timestamp on USER_ROLE if access needs time-boxing or approval workflows.
- •Collapse TEAM_MEMBER and USER_ROLE into direct user-permission grants only if you truly do not need teams.