diff --git a/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/AssignmentOrigin.java b/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/AssignmentOrigin.java
new file mode 100644
index 00000000..1ec842f8
--- /dev/null
+++ b/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/AssignmentOrigin.java
@@ -0,0 +1,5 @@
+package com.cameleer3.server.core.rbac;
+
+public enum AssignmentOrigin {
+    direct, managed
+}
diff --git a/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/ClaimMappingRepository.java b/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/ClaimMappingRepository.java
new file mode 100644
index 00000000..8e76cae9
--- /dev/null
+++ b/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/ClaimMappingRepository.java
@@ -0,0 +1,13 @@
+package com.cameleer3.server.core.rbac;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.UUID;
+
+public interface ClaimMappingRepository {
+    List<ClaimMappingRule> findAll();
+    Optional<ClaimMappingRule> findById(UUID id);
+    UUID create(String claim, String matchType, String matchValue, String action, String target, int priority);
+    void update(UUID id, String claim, String matchType, String matchValue, String action, String target, int priority);
+    void delete(UUID id);
+}
diff --git a/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/ClaimMappingRule.java b/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/ClaimMappingRule.java
new file mode 100644
index 00000000..fe13d840
--- /dev/null
+++ b/cameleer3-server-core/src/main/java/com/cameleer3/server/core/rbac/ClaimMappingRule.java
@@ -0,0 +1,18 @@
+package com.cameleer3.server.core.rbac;
+
+import java.time.Instant;
+import java.util.UUID;
+
+public record ClaimMappingRule(
+        UUID id,
+        String claim,
+        String matchType,
+        String matchValue,
+        String action,
+        String target,
+        int priority,
+        Instant createdAt
+) {
+    public enum MatchType { equals, contains, regex }
+    public enum Action { assignRole, addToGroup }
+}