Atlas

Roles & Permissions

The built-in roles, exactly what each one can do, and the scope levels it can be assigned at. Roles are capability bundles; assigning them is done by an admin.

Permission enforcement

Every capability verb in the catalog and how it is actually gated today. Each verb is classified exactly once — a guard test keeps this reference honest.

Enforced
A verb-level check gates the feature.
Coarse
Ships, but gated broadly (owner wildcard or room membership).
Permission Status
Approve and promote changes to definitions of record, and resolve convergence checks between overlapping definitions
definition:approve 		Enforced
Assign tasks
task:assign 		Enforced
Create tasks
task:create 		Enforced
Install skills
skill:manage 		Enforced
Manage areas
area:manage 		Enforced
Manage connections
connection:manage 		Enforced
Manage environments
environment:manage 		Enforced
Manage secrets
secret:manage 		Enforced
Manage tenant settings
tenant:settings 		Enforced
Manage workspaces
workspace:manage 		Enforced
Propose definitions of record
definition:propose 		Enforced
Read definitions of record
definition:read 		Enforced
Run sandbox analyses
analysis:run_sandbox 		Enforced
Start conversations
conversation:create 		Enforced
Update task status
task:update 		Enforced
View tasks
task:view 		Enforced
Invite collaborators
collaborator:invite 		Coarse
Invite members
member:invite 		Coarse
Manage groups
group:manage 		Coarse
Manage identity providers
idp:manage 		Coarse
Read conversations
conversation:read 		Coarse
Reply in conversations
conversation:participate 		Coarse

The owner role's * wildcard grants every verb and is not itself a discrete permission.

The built-in roles

Viewer

viewer

Read conversations, definitions, and tasks — and propose a change to any definition you can read (its owning group still approves it).

  • Read conversations
  • Read definitions of record
  • Propose definitions of record
  • View tasks

Can be assigned at

  • Account
  • Workspace
  • Area

Collaborator

collaborator

Everything a viewer can do, plus replying in conversations someone else started.

  • Read conversations
  • Read definitions of record
  • Propose definitions of record
  • View tasks
  • Reply in conversations
  • Update task status

Can be assigned at

  • Account
  • Workspace
  • Area

Approver

approver

Everything a collaborator can do, plus governing definitions of record: signing off on and promoting a change, and retiring, moving or reassigning a page. The governance authority on its own, without the rest of a contributor's capabilities. Signing off for a group also requires being a member of it.

  • Read conversations
  • Read definitions of record
  • Propose definitions of record
  • View tasks
  • Reply in conversations
  • Update task status
  • Approve and promote changes to definitions of record, and resolve convergence checks between overlapping definitions

Can be assigned at

  • Account
  • Workspace
  • Area

Contributor

contributor

Start conversations, run sandbox analyses, propose work, invite collaborators, and create or assign tasks.

  • Read conversations
  • Read definitions of record
  • Propose definitions of record
  • View tasks
  • Start conversations
  • Run sandbox analyses
  • Invite collaborators
  • Create tasks
  • Update task status
  • Assign tasks

Can be assigned at

  • Account
  • Workspace
  • Area

Connection Admin

connection_admin

Manage connections and secrets — nothing else.

  • Manage connections
  • Manage secrets

Can be assigned at

  • Account
  • Workspace
  • Area

Admin

admin

Workspace administration: manage a workspace's environments, connections, areas, and the skills its agent follows. Secrets stay with the connection admin and the owner; account-level administration stays with the owner.

  • Manage environments
  • Manage areas
  • Manage connections
  • Install skills

Can be assigned at

  • Account
  • Workspace
  • Area

Owner

owner

The account owner — unrestricted access, including account-level administration (identity, members, groups, settings, workspaces).

  • Everything

Can be assigned at

  • Account