Roles and permissions

This page lists what each role can do. Use it to pick a role for a user and scopes for an API token.

Roles

Role	Summary
owner	Every permission.
admin	Every permission except org.manage.
operator	View, basic commands, acknowledge incidents.
viewer	View only.

Roles are fixed. You cannot create custom roles. Assign roles in Users and roles.

Permission matrix

Permission	Allows	owner	admin	operator	viewer
org.manage	Users and roles; create, rename, delete sites and groups; hostname, timezone, config export, support access, diagnostics; revoke service certificates; force service renewal; extend licences	✓
device.view	See Edges, sites, groups, templates, configuration layers, incidents, commands; read Billing, Usage, Health, Certificates	✓	✓	✓	✓
telemetry.view	See assets, metrics, time series, discovery results, alarm rules	✓	✓	✓	✓
device.enroll	Create Edge enrolment commands; approve or reject Edges; create operators and App invitations	✓	✓
device.deactivate	Deactivate or replace an Edge; revoke a device certificate	✓	✓
device.move	Move an Edge to another group in its site	✓	✓
device.command.basic	Send rebirth, rediscover, restart_connector; cancel commands	✓	✓	✓
config.edit	Edit configuration layers and secrets; validate configuration	✓	✓
template.edit	Create, edit, publish, archive templates	✓	✓
rollout.manage	Create and control rollouts, including agent updates	✓	✓
config.high_risk	Reserved for high-risk changes. No portal action checks it on its own today.	✓	✓
access.grant	View, grant, revoke, retry App access to Edges	✓	✓
alarm.ack	Acknowledge incidents	✓	✓	✓
alarm.edit	Create, change, delete alarm rules	✓	✓
audit.view	Read and export the audit log; Refresh on Billing	✓	✓

Creating an API token is not a permission. It needs an owner role over the whole organization and a signed-in portal session. See Settings and API tokens.

Scopes

A user gets a role through a binding at one of three scopes.

Scope	Covers
Organization	Everything
Site	The site and all its groups
Group	Only that group

A user can hold several bindings. An action is allowed when any one binding includes the permission and covers the target.

• Lists such as Edges, Sites, Templates, and Audit show only what the user's bindings cover.
• These need a role over the whole organization: Users, Operators, Billing, Usage, Health, Certificates, and the owner sections of Settings.

What the portal shows

The portal also hides some controls by the user's organization-wide role.

Control	Shown to
Operators, Users, Manage users	owner, admin
Add Edge, Approve, Reject, certificate Revoke, Billing Refresh, alarm rule form	owner, admin
Ack on incidents	owner, admin, operator
Create, rename, delete sites and groups; Bindings form; Timezone, Hostname, Config export, Support access; Extend licence; Collect diagnostics; Force service renewal	owner

Note

The sidebar shows Users to admins, but only owners can use the page. Admins see "You cannot manage users."

API token scopes

Token scopes use the permission names above. A token can use a permission only when the scope is on the token and its owner's role still allows it.

Second factor

Every request needs a session that has passed the second sign-in step. A session with only a password reaches nothing in the portal.