Permissions and roles

All 109 permissions, the 7 built-in roles, and which are high impact.

Permissions are resource:action. The console uses them to decide what to render; the API uses them to decide what to allow. Only the second one is authoritative — a hidden button is a courtesy, not a control.

Two extra gates

HIGH_IMPACT permissions can never be granted implicitly through a wildcard; they must appear on the role explicitly. STEP_UP permissions additionally require a fresh re-authentication at the moment of use, no matter how old the session is.

#Built-in roles

Role	Permissions	Purpose
`OWNER`	109	Full control of the organization, including deletion and billing.
`ADMIN`	89	General administration of workspaces, people, policies and integrations.
`SECURITY_ADMIN`	61	Security, risk, credentials, incidents and emergency controls across the organization.
`DEVELOPER`	59	Build and operate agents, tools, policies and delegations in the assigned scope.
`APPROVER`	25	Review and decide human approval requests.
`AUDITOR`	27	Read-only access to audit, security and compliance evidence.
`VIEWER`	21	Read-only access to operational data.

Roles are a starting point, not a ceiling. Create a custom role when a team needs a different shape — for example an on-call role with agent:pause and security:read but nothing that can change policy.

#Every permission

Grouped by resource. ↑ marks high impact, ⚿ marks step-up required.

Permission	Flags	OWNER	ADMIN	SECURITY_ADMIN	DEVELOPER	APPROVER	AUDITOR	VIEWER
a2a
`a2a:read`		●	●	●	●	●	●	●
`a2a:connect`		●	●		●
`a2a:update`		●	●	●	●
`a2a:block`		●		●
action
`action:read`		●	●	●	●	●	●	●
`action:evaluate`		●	●		●
agent
`agent:read`		●	●	●	●	●	●	●
`agent:create`		●	●		●
`agent:update`		●	●		●
`agent:pause`		●	●	●	●
`agent:resume`		●	●	●	●
`agent:suspend`		●		●
`agent:revoke`	↑ ⚿	●		●
`agent:decommission`	↑ ⚿	●
`agent:rotate_credentials`		●	●	●	●
`agent:manage_capabilities`		●	●		●
apikey
`apikey:read`		●	●		●
`apikey:create`		●	●		●
`apikey:revoke`		●	●		●
approval
`approval:read`		●	●	●	●	●	●	●
`approval:approve`		●	●			●
`approval:deny`		●	●			●
`approval:delegate`		●	●			●
`approval:configure`		●	●
audit
`audit:read`		●	●	●	●	●	●
`audit:export`		●	●	●			●
`audit:configure_retention`	⚿	●		●
`audit:verify_integrity`		●	●	●			●
billing
`billing:read`		●	●
`billing:manage`		●	●
compliance
`compliance:read`		●	●	●			●
`compliance:manage`		●	●
credential
`credential:read_metadata`		●	●	●	●	●	●	●
`credential:create`		●	●	●	●
`credential:rotate`	⚿	●	●	●	●
`credential:revoke`	↑ ⚿	●		●
delegation
`delegation:read`		●	●	●	●	●	●	●
`delegation:create`		●	●		●
`delegation:update`		●	●		●
`delegation:revoke`		●	●	●	●
`delegation:simulate`		●	●	●	●
environment
`environment:read`		●	●	●	●	●	●	●
`environment:create`		●	●		●
`environment:update`		●	●		●
`environment:set_mode`		●	●		●
`environment:pause`	↑ ⚿	●		●
incident
`incident:read`		●	●	●			●
`incident:manage`		●		●
integration
`integration:read`		●	●		●
`integration:manage`		●	●
mcp
`mcp:read`		●	●	●	●	●	●	●
`mcp:register`		●	●		●
`mcp:update`		●	●	●	●
`mcp:disable`		●		●
member
`member:read`		●	●	●	●	●	●	●
`member:invite`		●	●
`member:update`		●	●
`member:remove`		●	●
network
`network:read`		●	●	●
`network:update`		●	●	●
notification
`notification:read`		●	●	●	●	●	●	●
`notification:manage`		●	●
organization
`organization:read`		●	●	●	●	●	●	●
`organization:update`		●	●
`organization:delete`	↑ ⚿	●
passport
`passport:read`		●	●	●	●	●	●	●
`passport:issue`		●	●		●
`passport:verify`		●	●	●	●
`passport:revoke`		●		●
policy
`policy:read`		●	●	●	●	●	●	●
`policy:create`		●	●	●	●
`policy:update`		●	●	●	●
`policy:delete`		●
`policy:simulate`		●	●	●	●
`policy:activate`	↑ ⚿	●		●
`policy:rollback`	↑ ⚿	●		●
`policy:bind`		●	●	●	●
registry
`registry:read`		●	●	●	●	●	●	●
`registry:publish`		●	●		●
`registry:unpublish`		●	●		●
resource
`resource:read`		●	●	●	●	●	●	●
`resource:manage`		●	●		●
risk
`risk:read`		●	●	●	●	●	●	●
`risk:configure`		●		●
`risk:acknowledge`		●		●
role
`role:read`		●	●	●	●	●	●	●
`role:create`		●	●
`role:update`		●	●
`role:delete`		●	●
scim
`scim:read`		●	●
`scim:update`		●	●
security
`security:read`		●	●	●			●
`security:emergency_action`	↑ ⚿	●		●
`security:break_glass`	↑ ⚿	●		●
sso
`sso:read`		●	●
`sso:update`	⚿	●	●
tool
`tool:read`		●	●	●	●	●	●	●
`tool:create`		●	●		●
`tool:update`		●	●	●	●
`tool:disable`		●		●
trust
`trust:read`		●	●	●	●	●	●	●
`trust:manage`		●		●
usage
`usage:read`		●	●	●	●	●	●	●
webhook
`webhook:read`		●	●		●
`webhook:manage`		●	●		●
workspace
`workspace:read`		●	●	●	●	●	●	●
`workspace:create`		●	●
`workspace:update`		●	●
`workspace:delete`		●	●

#High impact

These are irreversible or have a large blast radius, so a wildcard grant does not reach them.

agent:revoke
agent:decommission
credential:revoke
policy:activate
policy:rollback
security:emergency_action
security:break_glass
organization:delete
environment:pause

#Step-up required

Holding the permission is not enough. The session must have re-authenticated recently, and the step-up window is short on purpose.

agent:revoke
agent:decommission
credential:revoke
credential:rotate
policy:activate
policy:rollback
security:emergency_action
security:break_glass
sso:update
organization:delete
audit:configure_retention
environment:pause