What each of the four roles can do, per resource. Roles are hierarchical, so each row states the minimum role required.

The minimum role required for each action. Roles are hierarchical: Owner includes Admin, Admin includes Operator, Operator includes Viewer.

Quick reference#

Role	Reads	Changes production	Changes who may change production
Viewer	yes	no	no
Operator	yes	yes	no
Admin	yes	yes	yes
Owner	yes	yes	yes, and can delete the organisation

Inventory#

Action	Minimum role
View servers, environments and their variables	Viewer
Register, edit or delete a server	Operator
Create or edit an environment	Operator
Generate, import, rename or delete an SSH key	Operator
Connect or disconnect a secret provider	Operator

Plans and runs#

Action	Minimum role
View plans, steps and run history	Viewer
Create, edit or delete a plan	Operator
Draft a plan with the composer	Operator
Start a run, including a dry run	Operator
Abort a run	Operator
Resolve an approval, approve or reject	Operator
Create, edit or delete a schedule	Operator

Access and membership#

Action	Minimum role
View your own organisation membership	Viewer
List members and pending invitations	Admin
Invite a member, or revoke an invitation	Admin
Change a member's role	Admin
Remove a member	Admin
Grant or revoke access to a protected environment	Admin
Approve or deny an environment access request	Admin
Grant or revoke access to a collection	Admin
Change organisation settings	Admin
Delete the organisation	Owner

Audit#

Action	Minimum role
Read the audit log, and its filter values	Admin

Git and templates#

Action	Minimum role
View git sources and their sync history	Viewer
Add, edit or delete a git source or connection	Operator
Trigger a sync, enable or disable a webhook	Operator
Create, edit or roll back a config template	Operator

The boundary that matters#

Operator to Admin. An Operator changes production: they run plans, edit them, manage inventory and resolve approvals. An Admin changes who may change production: membership, roles, environment grants, and reading the record of what everyone did.

Grant Operator broadly and Admin narrowly. That is the shape the permissions were built around.

Rules that apply to every row#

Approval requires Operator or above. A Viewer cannot approve, which keeps the decision with someone who could have made the change themselves.

Protected environments narrow further. Even an Operator needs an explicit grant to see, run against, or manage an environment marked protected. A grant can carry an expiry.

Tenancy is checked before the role. Every read is scoped to the caller's tenant and every change by id asserts ownership. Something outside your tenant returns not found rather than forbidden, so an id cannot be probed.

API tokens carry their creator's role. A token made by an Admin can do Admin things. Create tokens from the narrowest account that does the job.

Role permissions