# LS5012: Role Allows an Undeclared Permission

## Intent

LS5012 is a compiler check that reports a role record allowing a permission no permission record declares, because the generator writes each role's allowed permissions from the shared permission list. This page states what the rule reports, where the error sits, and how to declare the permission or remove it from the role.

## Reference

### What the Rule Enforces

LS5012 enforces [Generate the Registry, Permissions, and Roles from the Records](https://litespec.dev/4.0.0/backend/dotnet/stack.md#generate-the-registry-permissions-and-roles-from-the-records) (`litespec/backend/dotnet/stack#generate-the-registry-permissions-and-roles-from-the-records`). It runs on Domain, Application, Infrastructure, and WebApi files, where the generator writes role entries. Its category is `LiteSpec.Traceability`.

### What the Rule Reports

The generator reads each role's `allows` list against the permission records, so every allowed permission is one the shared list defines. A role allowing a permission no record declares is still emitted, and the rule reports it, naming the role and the permission. The diagnostic has no source location, because the unknown permission lives in the records.

### Failing Example

The `role/finance` record allows `permission/mint-money`, which no permission record declares, so the entry carries it and the rule reports.

### Passing Example

The `role/finance` record allows `permission/reimburse-expense`, which the permission list declares, so the entry carries it and the rule stays silent.

### How to Fix

Declare the permission in the shared permission list, or remove it from the role's `allows` list, so every allowed permission is one the list defines.

## Notes

### What the Rule Ignores

The rule does not run in test projects, where no role entries are generated. It stays silent when no `.litespec/project.json` is in reach, or when the docs root it names cannot be resolved; the CLI owns that configuration error.

### Severity

The rule is an error whenever it fires, because the role allows a permission the shared list does not define. An `.editorconfig` entry for the rule id overrides it.