diff --git a/backend/internal/data/ent/schema/auth_roles.go b/backend/internal/data/ent/schema/auth_roles.go
new file mode 100644
index 0000000..5333eb3
--- /dev/null
+++ b/backend/internal/data/ent/schema/auth_roles.go
@@ -0,0 +1,34 @@
+package schema
+
+import (
+	"entgo.io/ent"
+	"entgo.io/ent/schema/edge"
+	"entgo.io/ent/schema/field"
+)
+
+// AuthRoles holds the schema definition for the AuthRoles entity.
+type AuthRoles struct {
+	ent.Schema
+}
+
+// Fields of the AuthRoles.
+func (AuthRoles) Fields() []ent.Field {
+	return []ent.Field{
+		field.Enum("role").
+			Default("user").
+			Values(
+				"admin",       // can do everything - currently unused
+				"user",        // default login role
+				"attachments", // Read Attachments
+			),
+	}
+}
+
+// Edges of the AuthRoles.
+func (AuthRoles) Edges() []ent.Edge {
+	return []ent.Edge{
+		edge.From("token", AuthTokens.Type).
+			Ref("roles").
+			Unique(),
+	}
+}
diff --git a/backend/internal/data/ent/schema/auth_tokens.go b/backend/internal/data/ent/schema/auth_tokens.go
index 0cfd4d1..e29b79a 100644
--- a/backend/internal/data/ent/schema/auth_tokens.go
+++ b/backend/internal/data/ent/schema/auth_tokens.go
@@ -37,6 +37,8 @@ func (AuthTokens) Edges() []ent.Edge {
 		edge.From("user", User.Type).
 			Ref("auth_tokens").
 			Unique(),
+		edge.To("roles", AuthRoles.Type).
+			Unique(),
 	}
 }