Roles and permissions reference

Roles determine what a user or service account can do within Itential Cloud and its licensed components. All available roles are listed below, organized by product and application.

To learn how Itential Cloud uses roles to govern permissions, see Manage users and groups.

Roles marked with an asterisk (*) are currently non-functional as they undergo further development.

Cloud API

Roles in the Cloud API collection govern permissions for the Itential Cloud portal UI and API.

Role	Description
`clusters:read`	View which cluster Itential Platform instances are assigned to.
`deployments:delete`	Delete Itential Platform instances.
`groups:read`	View groups.
`groups:write`	Create, update, and delete groups.
`insights:view`	Access Insights.
`jobs:view-detail`	View job details. See Access control in Job Viewer.
`jobs:view-metadata`	View all job and task information except variables. See Access control in Job Viewer.
`organizations:read`	Retrieve license information including the current Itential Platform instance limit. Required to create new Itential Platform instances.
*`organizations:write`	N/A
`security:read`	View security information of user accounts.
`security:write`	Edit security permissions of user accounts.
`training-deployments:read`	View Itential Academy training environments. Required to launch a training environment.
`training-deployments:write`	Create and delete Itential Academy training environments. Required to launch a training environment.
`users:read`	View user accounts.
`users:write`	Create, update, and delete user accounts.

FlowAI roles

FlowAI uses application-level permissions to control access to agent projects, decorators, and agent sessions. These permissions are independent of project-level roles such as Owner, Editor, and Viewer, and must be explicitly assigned. For information about project-level roles, see Agent Projects.

Name	Description
`agents:read`	Access to Agent Projects and agents. Users see only the projects they have project-level membership on. Without this permission, Agent Projects isn’t visible in the UI even if a user has project-level membership.
`agents:write`	Requires `agents:read`. Create and edit agents and projects, or import a project package. Doesn’t grant access to any existing project; project-level membership is governed separately. For information, see
`agents:delete`	Requires `agents:read`. Delete agents and projects permanently.
`agents:admin`	Access to all `/admin/`-prefixed endpoints. Grants administrative access to every agent project regardless of project-level membership, so admins can manage orphaned or inaccessible projects. All actions are recorded in the audit log.
`tool-decorators:read`	View available decorators when creating or editing an agent, and export decorator definitions via API.
`tool-decorators:write`	Includes `tool-decorators:read`. Create, clone, and import decorator definitions. Available only in the API.
`tool-decorators:delete`	Includes `tool-decorators:read`. Delete decorator definitions via API.
`sessions:read`	Access to Agent Sessions. Required to view any session. Without this permission, Agent Sessions isn’t visible in the UI.
`sessions:write`	Pause, resume, and cancel sessions. Requires `sessions:read`.
`sessions:delete`	Delete sessions permanently, including the session record and audit trail. Requires `sessions:read`.
`tool-registry:read`	Access tool information.
`tool-registry:discover`	Discover tools.
`provider-profiles:read`	View all provider profiles in Model Registry.
`provider-profiles:write`	Create and edit all provider profiles in Model Registry.
`provider-profiles:delete`	Delete all provider profiles in Model Registry.

Grant FlowAI access

FlowAI permissions span four applications: Agent Projects, Agent Sessions, Tool Registry, and Model Registry. Grant permissions for the application and action a user actually needs, rather than as a single bundle. For example, managing Model Registry profiles doesn’t require any Agent Sessions permissions, and monitoring sessions doesn’t require any Agent Projects permissions.

Agent Projects

To do this	Grant
Create and edit agents and projects, and browse available tools and decorators	`agents:read`, `agents:write`, `tool-decorators:read`, `tool-registry:read`, `tool-registry:discover`
Also create, clone, and delete decorators	`tool-decorators:write`, `tool-decorators:delete`
Also manage any project regardless of membership, including orphaned or inaccessible ones	`agents:delete`, `agents:admin`

Agent Sessions

To do this	Grant
Monitor agent session activity	`sessions:read`
Also pause, resume, cancel, and delete sessions	`sessions:write`, `sessions:delete`

Model Registry

To do this	Grant
View provider profiles	`provider-profiles:read`
Also create, edit, and delete profiles	`provider-profiles:write`, `provider-profiles:delete`

Gateway Manager

Roles in the Gateway Manager collection govern permissions for the Gateway Manager UI and API.

Role	Description
`certificate:read`	View certificates.
`certificate:create`	Add certificates to the certificate store.
`certificate:update`	Update the certificate alias.
`certificate:delete`	Delete a certificate.
`gateway:read`	View a specific gateway. Requires assignment to an authorization group with `gateway:read` that is assigned to the gateway.
`gateway:create`	Create a gateway.
`gateway:update`	Update a specific gateway. Requires assignment to an authorization group with `gateway:update` that is assigned to the gateway.
`gateway:delete`	Delete a specific gateway. Requires assignment to an authorization group with `gateway:delete` that is assigned to the gateway.
`service-group:read`	View service groups associated with a specific gateway. Requires assignment to an authorization group with `service-group:read` that is assigned to the gateway.
`service-group:create`	Create a service group associated with a specific gateway. Requires assignment to an authorization group with `service-group:create` that is assigned to the gateway.
`service-group:update`	Update service groups associated with a specific gateway. Requires assignment to an authorization group with `service-group:update` that is assigned to the gateway.
`service-group:delete`	Delete service groups associated with a specific gateway. Requires assignment to an authorization group with `service-group:delete` that is assigned to the gateway.
`service:run`	Run a service via the `runService` workflow task or API. Requires assignment to an authorization group with `service:run` assigned to the gateway or a service group.
`service:read`	View a specific service via the `runService` workflow task or API. Requires assignment to an authorization group with `service:read` assigned to the gateway or a service group.

Inventory Manager

Roles in the Inventory Manager collection govern permissions for the Inventory Manager UI and API.

Role	Description
`inventory:read`	View inventories, nodes, and actions.
`inventory:create`	Create inventories, nodes, and actions.
`inventory:update`	Modify existing inventory resources and manage actions.
`inventory:delete`	Delete inventories, nodes, and actions.
`inventory:run`	Execute actions against inventory nodes.

Itential Platform

Roles in the Itential Platform collection govern permissions for a specific Itential Platform instance.

Admin Essentials

Role	Description
`adapters:delete`	Delete adapters, integrations, and integration models.
`adapters:read`	View information about adapters, integrations, and integration models.
`adapters:write`	Create and update adapters, integrations, and integration models.
`groups:read`	View user groups.
`indexes:read`	View information in Admin Essentials.
`prebuilts:delete`	Uninstall pre-builts.
`prebuilts:read`	View installed pre-builts.
`prebuilts:write`	Install pre-builts.
`prebuilts:repositories:delete`	Delete pre-built repositories.
`prebuilts:repositories:read`	View pre-built repositories.
`prebuilts:repositories:write`	Create and edit pre-built repositories.
`roles:read`	View user roles.
`tags:delete`	Delete tags.
`tags:read`	View tags.
`tags:write`	Create and edit tags.
`users:read`	View user accounts.

Configuration Manager

Role	Description
`compliance:read`	View device compliance reports.
`compliance:run`	Run compliance checks against devices.
`configurations:read`	View current device configurations.
`configurations:write`	Edit current device configurations.
`configurations:golden:delete`	Delete golden configurations.
`configurations:golden:read`	View golden configurations.
`configurations:golden:write`	Create and edit golden configurations.
`configurations:parsers:delete`	Delete configuration parsers.
`configurations:parsers:read`	View configuration parsers.
`configurations:parsers:write`	Create and edit configuration parsers.
`configurations:templates:delete`	Delete configuration templates.
`configurations:templates:read`	View configuration templates.
`configurations:templates:write`	Create and edit configuration templates.
`devices:backups:delete`	Delete device backups.
`devices:backups:read`	View device backups.
`devices:backups:write`	Create, edit, and import device backups.
`devices:groups:delete`	Delete device groups.
`devices:groups:read`	View device groups.
`devices:groups:write`	Create and edit device groups.
`devices:read`	View devices.
`devices:write`	Edit devices.
`pins:delete`	Delete pinned items.
`pins:read`	View pinned items.
`pins:write`	Create and edit pinned items.

Dashboard

Role	Description
`bookmarks:delete`	Delete bookmarks.
`bookmarks:read`	View bookmarks.
`bookmarks:write`	Create and edit bookmarks.
`system:read`	View system information about Itential Platform.

Miscellaneous roles

Role	Application	Description
`AGManager:admin`	AG Manager	Discover and interact with modules, scripts, and playbooks sourced from Gateway. Required to view Gateway-sourced content.
`cloud:config:read`	Itential Cloud Portal	View Itential Platform roles available for assignment.
`cloud:config:write`	Itential Cloud Portal	Add, remove, and update Itential Platform roles.
`cloud:directconnect:admin`	Direct Connect	Connect to Gateway instances from Itential Platform. Required to view Gateway-sourced content.
`cloud:encrypt:read`	App-Encrypt	Use encryption features in Itential Platform.
`datasets:delete`	Data Sets	Delete a data set export.
`datasets:read`	Data Sets	View and search data set exports.
`datasets:write`	Data Sets	Create a data set export.
`search:read`	System Search	Search for resources using the System Search feature.
`tags:assign`	Multiple	Assign tags to resources.
`workcenter:write`	Work Center	Access Work Center and act on manual tasks in your queue.

NSO Manager

Role	Description
`nso:cdb:admin`	Set items in NACM groups.
`nso:cdb:read`	Execute REST queries.
`nso:cdb:write`	Set leaf values and execute REST actions.
`nso:commitqueue:read`	View the commit queue.
`nso:commitqueue:write`	Edit the commit queue.
`nso:devices:read`	View devices.
`nso:devices:write`	Run actions and commands on devices.
`nso:groups:read`	View authorization groups.
`nso:neds:read`	View NEDs.

Operations Manager and Workflow Engine

Role	Application	Description
`jobs:admin`	Operations Manager	Create, view, update, and delete job groups.
`jobs:delete`	Operations Manager and Workflow Engine	Cancel jobs.
`jobs:read`	Operations Manager and Workflow Engine	View jobs.
`jobs:write`	Operations Manager and Workflow Engine	Create, start, and work jobs.
`tasks:admin`	Operations Manager	Full control of any tasks.
`tasks:read`	Operations Manager	View tasks.
`tasks:work`	Operations Manager	Interact with actionable tasks.
`workflows:engine:read`	Workflow Engine	View the status of Workflow Engine.
`workflows:engine:write`	Workflow Engine	Activate and deactivate Workflow Engine.
`workflows:triggers:delete`	Operations Manager	Delete triggers.
`workflows:triggers:read`	Operations Manager	View triggers.
`workflows:triggers:write`	Operations Manager	Create and edit triggers.

Service Catalog and Service Catalog Builder

Role	Application	Description
`services:instances:delete`	Service Catalog Builder	Delete services.
`services:instances:order`	Service Catalog	Create and invoke service orders.
`services:instances:read`	Service Catalog	View services.
`services:instances:write`	Service Catalog Builder	Create and edit services.
`services:models:delete`	Service Catalog	Delete service models.
`services:models:read`	Service Catalog	View service models.
`services:models:write`	Service Catalog	Create and edit service models.

Studio

Role	Description
`forms:admin`	Create, update, and delete form groups.
`forms:delete`	Delete forms.
`forms:read`	View forms.
`forms:write`	Create and edit forms.
`mops:delete`	Delete command templates.
`mops:read`	View command templates.
`mops:run`	Execute command templates.
`mops:write`	Create and edit command templates.
`templates:delete`	Delete templates.
`templates:read`	View templates.
`templates:write`	Create and edit templates.
`transformations:delete`	Delete transformations.
`transformations:read`	View transformations.
`transformations:write`	Create and edit transformations.
`workflows:admin`	Full control of workflows.
`workflows:delete`	Delete workflows.
`workflows:read`	View workflows.
`workflows:write`	Create and edit workflows.