# Role permissions

What each of the four roles can do, per resource. Roles are hierarchical, so each row states the minimum role required.

Source: https://opafra.com/docs/governance/roles

---

The minimum role required for each action. Roles are hierarchical: Owner includes Admin,
Admin includes Operator, Operator includes Viewer.

## Quick reference

| Role | Reads | Changes production | Changes who may change production |
|---|---|---|---|
| Viewer | yes | no | no |
| Operator | yes | yes | no |
| Admin | yes | yes | yes |
| Owner | yes | yes | yes, and can delete the organisation |

## Inventory

| Action | Minimum role |
|---|---|
| View servers, environments and their variables | Viewer |
| Register, edit or delete a server | Operator |
| Create or edit an environment | Operator |
| Generate, import, rename or delete an SSH key | Operator |
| Connect or disconnect a secret provider | Operator |

## Plans and runs

| Action | Minimum role |
|---|---|
| View plans, steps and run history | Viewer |
| Create, edit or delete a plan | Operator |
| Draft a plan with the composer | Operator |
| Start a run, including a dry run | Operator |
| Abort a run | Operator |
| Resolve an approval, approve or reject | Operator |
| Create, edit or delete a schedule | Operator |

## Access and membership

| Action | Minimum role |
|---|---|
| View your own organisation membership | Viewer |
| List members and pending invitations | Admin |
| Invite a member, or revoke an invitation | Admin |
| Change a member's role | Admin |
| Remove a member | Admin |
| Grant or revoke access to a protected environment | Admin |
| Approve or deny an environment access request | Admin |
| Grant or revoke access to a collection | Admin |
| Change organisation settings | Admin |
| Delete the organisation | Owner |

## Audit

| Action | Minimum role |
|---|---|
| Read the audit log, and its filter values | Admin |

## Git and templates

| Action | Minimum role |
|---|---|
| View git sources and their sync history | Viewer |
| Add, edit or delete a git source or connection | Operator |
| Trigger a sync, enable or disable a webhook | Operator |
| Create, edit or roll back a config template | Operator |

## The boundary that matters

**Operator to Admin.** An Operator changes production: they run plans, edit them, manage
inventory and resolve approvals. An Admin changes *who may change production*: membership,
roles, environment grants, and reading the record of what everyone did.

Grant Operator broadly and Admin narrowly. That is the shape the permissions were built
around.

## Rules that apply to every row

**Approval requires Operator or above.** A Viewer cannot approve, which keeps the decision
with someone who could have made the change themselves.

**Protected environments narrow further.** Even an Operator needs an explicit grant to
see, run against, or manage an environment marked protected. A grant can carry an expiry.

**Tenancy is checked before the role.** Every read is scoped to the caller's tenant and
every change by id asserts ownership. Something outside your tenant returns not found
rather than forbidden, so an id cannot be probed.

**API tokens carry their creator's role.** A token made by an Admin can do Admin things.
Create tokens from the narrowest account that does the job.

## See also

- [Organisations and roles](/docs/access/organisations-and-roles) for tenancy and grants
- [Audit log](/docs/governance/audit-log) for what each action records