Roles & Permissions
The six built-in roles, exactly what each one can do, and the scope levels it can be assigned at. Roles are capability bundles; assigning them is done by an admin.
Permission enforcement
Every capability verb in the catalog and how it is actually gated today. Each verb is classified exactly once — a guard test keeps this reference honest.
A verb-level check gates the feature.
Ships, but gated broadly (admin wildcard or room membership).
Reserved in the catalog — the feature isn't built yet.
| Permission | Status | Granted to |
|---|---|---|
|
Assign tasks
task:assign
|
Enforced |
Contributor
Account Admin
|
|
Create tasks
task:create
|
Enforced |
Contributor
Account Admin
|
|
Manage areas
area:manage
|
Enforced |
Admin
Account Admin
|
|
Manage connections
connection:manage
|
Enforced |
Connection Admin
Admin
Account Admin
|
|
Manage environments
environment:manage
|
Enforced |
Admin
Account Admin
|
|
Manage tenant settings
tenant:settings
|
Enforced |
Account Admin
|
|
Manage workspaces
workspace:manage
|
Enforced |
Account Admin
|
|
Propose definitions of record
definition:propose
|
Enforced |
Contributor
Account Admin
|
|
Read definitions of record
definition:read
|
Enforced |
Viewer
Collaborator
Contributor
Account Admin
|
|
Run sandbox analyses
analysis:run_sandbox
|
Enforced |
Contributor
Account Admin
|
|
Start conversations
conversation:create
|
Enforced |
Contributor
Account Admin
|
|
Update task status
task:update
|
Enforced |
Collaborator
Contributor
Account Admin
|
|
View tasks
task:view
|
Enforced |
Viewer
Collaborator
Contributor
Account Admin
|
|
Invite members
member:invite
|
Coarse |
Account Admin
|
|
Manage groups
group:manage
|
Coarse |
Account Admin
|
|
Manage identity providers
idp:manage
|
Coarse |
Account Admin
|
|
Manage secrets
secret:manage
|
Coarse |
Connection Admin
Account Admin
|
|
Read conversations
conversation:read
|
Coarse |
Viewer
Collaborator
Contributor
Account Admin
|
|
Reply in conversations
conversation:participate
|
Coarse |
Collaborator
Account Admin
|
|
Invite collaborators
collaborator:invite
|
Coming soon |
Contributor
Account Admin
|
|
Manage deploy policy
deploy:policy
|
Coming soon |
Connection Admin
Account Admin
|
|
View dashboards
dashboard:read
|
Coming soon |
Viewer
Collaborator
Contributor
Account Admin
|
The account_admin role's * wildcard grants every verb and is not itself a discrete permission.
The six built-in roles
Viewer
viewer
Read-only access to conversations, definitions, and dashboards.
- Read conversations
- Read definitions of record
- View dashboards Coming soon
- View tasks
Can be assigned at
- Account
- Workspace
- Area
Collaborator
collaborator
Everything a viewer can do, plus replying in conversations someone else started.
- Read conversations
- Read definitions of record
- View dashboards Coming soon
- View tasks
- Reply in conversations
- Update task status
Can be assigned at
- Account
- Workspace
- Area
Contributor
contributor
Start conversations, run sandbox analyses, and propose definitions of record.
- Read conversations
- Read definitions of record
- View dashboards Coming soon
- View tasks
- Start conversations
- Run sandbox analyses
- Propose definitions of record
- Invite collaborators Coming soon
- Create tasks
- Update task status
- Assign tasks
Can be assigned at
- Account
- Workspace
- Area
Connection Admin
connection_admin
Manage connections, secrets, and deploy policy — nothing else.
- Manage connections
- Manage secrets
- Manage deploy policy Coming soon
Can be assigned at
- Account
- Workspace
- Area
Admin
admin
Workspace administration: manage a workspace's environments, connections, and its areas (including their secrets).
- Manage environments
- Manage areas
- Manage connections
Can be assigned at
- Account
- Workspace
- Area
Account Admin
account_admin
The account owner — unrestricted access, including account-level administration (identity, members, groups, settings, workspaces).
- Everything
Can be assigned at
- Account