> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.itential.com/itential-cloud/cloud-hub/administration/roles-permissions/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server. # Roles and permissions reference > Complete reference of all roles available for assignment in Itential Cloud, organized by product and application. Roles determine what a user or service account can do within Itential Cloud and its licensed components. All available roles are listed below, organized by product and application. To learn how Itential Cloud uses roles to govern permissions, see [Manage users and groups](/itential-cloud/cloud-hub/administration/manage-users-groups#groups). Roles marked with an asterisk (\*) are currently non-functional as they undergo further development. ## Cloud API Roles in the **Cloud API** collection govern permissions for the Itential Cloud portal UI and API. | Role | Description | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `clusters:read` | View which cluster Itential Platform instances are assigned to. | | `deployments:delete` | Delete Itential Platform instances. | | `groups:read` | View groups. | | `groups:write` | Create, update, and delete groups. | | `insights:view` | Access [Insights](/itential-cloud/cloud-hub/insights/overview). | | `jobs:view-detail` | View job details. See [Access control in Job Viewer](/itential-cloud/cloud-hub/job-viewer/access-control). | | `jobs:view-metadata` | View all job and task information except variables. See [Access control in Job Viewer](/itential-cloud/cloud-hub/job-viewer/access-control). | | `organizations:read` | Retrieve license information including the current Itential Platform instance limit. Required to create new Itential Platform instances. | | `projects:admin` | Grants system-wide admin access to Studio Projects, so an admin can view, reassign membership on, or delete any Studio project regardless of their individual project-level permissions. Available only through the API. For more information, see [Project Admin role](/itential-platform/studio/projects/create-manage#project-admin-role). | | `security:read` | View security information of user accounts. | | `security:read` | View security information of user accounts. | | `security:write` | Edit security permissions of user accounts. | | `training-deployments:read` | View Itential Academy training environments. Required to launch a training environment. | | `training-deployments:write` | Create and delete Itential Academy training environments. Required to launch a training environment. | | `users:read` | View user accounts. | | `users:write` | Create, update, and delete user accounts. | ## FlowAI roles FlowAI uses application-level permissions to control access to agent projects, decorators, and agent sessions. These permissions are independent of project-level roles such as Owner, Editor, and Viewer, and must be explicitly assigned. For information about project-level roles, see [Agent Projects](/itential-cloud/flowai/agent-projects#access-control). | Name | Description | | :------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `agents:read` | Access to Agent Projects and agents. Users see only the projects they have project-level membership on. Without this permission, Agent Projects isn't visible in the UI even if a user has project-level membership. | | `agents:write` | Requires `agents:read`. Create and edit agents and projects, or import a project package. Doesn't grant access to any existing project; project-level membership is governed separately. For information, see | | `agents:delete` | Requires `agents:read`. Delete agents and projects permanently. | | `agents:admin` | Access to all `/admin/`-prefixed endpoints. Grants administrative access to every agent project regardless of project-level membership, so admins can manage orphaned or inaccessible projects. All actions are recorded in the audit log. | | `tool-decorators:read` | View available decorators when creating or editing an agent, and export decorator definitions via API. | | `tool-decorators:write` | Includes `tool-decorators:read`. Create, clone, and import decorator definitions. Available only in the API. | | `tool-decorators:delete` | Includes `tool-decorators:read`. Delete decorator definitions via API. | | `sessions:read` | Access to Agent Sessions. Required to view any session. Without this permission, Agent Sessions isn't visible in the UI. | | `sessions:write` | Pause, resume, and cancel sessions. Requires `sessions:read`. | | `sessions:delete` | Delete sessions permanently, including the session record and audit trail. Requires `sessions:read`. | | `tool-registry:read` | Access tool information. | | `tool-registry:discover` | Discover tools. | | `provider-profiles:read` | View all provider profiles in Model Registry. | | `provider-profiles:write` | Create and edit all provider profiles in Model Registry. | | `provider-profiles:delete` | Delete all provider profiles in Model Registry. | ### Grant FlowAI access FlowAI permissions span four applications: Agent Projects, Agent Sessions, Tool Registry, and Model Registry. Grant permissions for the application and action a user actually needs, rather than as a single bundle. For example, managing Model Registry profiles doesn't require any Agent Sessions permissions, and monitoring sessions doesn't require any Agent Projects permissions. **Agent Projects** | To do this | Grant | | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | Create and edit agents and projects, and browse available tools and decorators | `agents:read`, `agents:write`, `tool-decorators:read`, `tool-registry:read`, `tool-registry:discover` | | Also create, clone, and delete decorators | `tool-decorators:write`, `tool-decorators:delete` | | Also manage any project regardless of membership, including orphaned or inaccessible ones | `agents:delete`, `agents:admin` | **Agent Sessions** | To do this | Grant | | ----------------------------------------------- | ----------------------------------- | | Monitor agent session activity | `sessions:read` | | Also pause, resume, cancel, and delete sessions | `sessions:write`, `sessions:delete` | **Model Registry** | To do this | Grant | | -------------------------------------- | ----------------------------------------------------- | | View provider profiles | `provider-profiles:read` | | Also create, edit, and delete profiles | `provider-profiles:write`, `provider-profiles:delete` | ## Gateway Manager Roles in the **Gateway Manager** collection govern permissions for the Gateway Manager UI and API. | Role | Description | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `certificate:read` | View certificates. | | `certificate:create` | Add certificates to the certificate store. | | `certificate:update` | Update the certificate alias. | | `certificate:delete` | Delete a certificate. | | `gateway:read` | View a specific gateway. Requires assignment to an authorization group with `gateway:read` that is assigned to the gateway. | | `gateway:create` | Create a gateway. | | `gateway:update` | Update a specific gateway. Requires assignment to an authorization group with `gateway:update` that is assigned to the gateway. | | `gateway:delete` | Delete a specific gateway. Requires assignment to an authorization group with `gateway:delete` that is assigned to the gateway. | | `service-group:read` | View service groups associated with a specific gateway. Requires assignment to an authorization group with `service-group:read` that is assigned to the gateway. | | `service-group:create` | Create a service group associated with a specific gateway. Requires assignment to an authorization group with `service-group:create` that is assigned to the gateway. | | `service-group:update` | Update service groups associated with a specific gateway. Requires assignment to an authorization group with `service-group:update` that is assigned to the gateway. | | `service-group:delete` | Delete service groups associated with a specific gateway. Requires assignment to an authorization group with `service-group:delete` that is assigned to the gateway. | | `service:run` | Run a service via the `runService` workflow task or API. Requires assignment to an authorization group with `service:run` assigned to the gateway or a service group. | | `service:read` | View a specific service via the `runService` workflow task or API. Requires assignment to an authorization group with `service:read` assigned to the gateway or a service group. | ## Inventory Manager Roles in the **Inventory Manager** collection govern permissions for the Inventory Manager UI and API. | Role | Description | | ------------------ | ------------------------------------------------------- | | `inventory:read` | View inventories, nodes, and actions. | | `inventory:create` | Create inventories, nodes, and actions. | | `inventory:update` | Modify existing inventory resources and manage actions. | | `inventory:delete` | Delete inventories, nodes, and actions. | | `inventory:run` | Execute actions against inventory nodes. | ## Itential Platform Roles in the **Itential Platform** collection govern permissions for a specific Itential Platform instance. ### Admin Essentials | Role | Description | | ------------------------------- | ---------------------------------------------------------------------- | | `adapters:delete` | Delete adapters, integrations, and integration models. | | `adapters:read` | View information about adapters, integrations, and integration models. | | `adapters:write` | Create and update adapters, integrations, and integration models. | | `groups:read` | View user groups. | | `indexes:read` | View information in Admin Essentials. | | `prebuilts:delete` | Uninstall pre-builts. | | `prebuilts:read` | View installed pre-builts. | | `prebuilts:write` | Install pre-builts. | | `prebuilts:repositories:delete` | Delete pre-built repositories. | | `prebuilts:repositories:read` | View pre-built repositories. | | `prebuilts:repositories:write` | Create and edit pre-built repositories. | | `roles:read` | View user roles. | | `tags:delete` | Delete tags. | | `tags:read` | View tags. | | `tags:write` | Create and edit tags. | | `users:read` | View user accounts. | ### Configuration Manager | Role | Description | | --------------------------------- | ---------------------------------------- | | `compliance:read` | View device compliance reports. | | `compliance:run` | Run compliance checks against devices. | | `configurations:read` | View current device configurations. | | `configurations:write` | Edit current device configurations. | | `configurations:golden:delete` | Delete golden configurations. | | `configurations:golden:read` | View golden configurations. | | `configurations:golden:write` | Create and edit golden configurations. | | `configurations:parsers:delete` | Delete configuration parsers. | | `configurations:parsers:read` | View configuration parsers. | | `configurations:parsers:write` | Create and edit configuration parsers. | | `configurations:templates:delete` | Delete configuration templates. | | `configurations:templates:read` | View configuration templates. | | `configurations:templates:write` | Create and edit configuration templates. | | `devices:backups:delete` | Delete device backups. | | `devices:backups:read` | View device backups. | | `devices:backups:write` | Create, edit, and import device backups. | | `devices:groups:delete` | Delete device groups. | | `devices:groups:read` | View device groups. | | `devices:groups:write` | Create and edit device groups. | | `devices:read` | View devices. | | `devices:write` | Edit devices. | | `pins:delete` | Delete pinned items. | | `pins:read` | View pinned items. | | `pins:write` | Create and edit pinned items. | ### Dashboard | Role | Description | | ------------------ | ------------------------------------------------ | | `bookmarks:delete` | Delete bookmarks. | | `bookmarks:read` | View bookmarks. | | `bookmarks:write` | Create and edit bookmarks. | | `system:read` | View system information about Itential Platform. | ### Miscellaneous roles | Role | Application | Description | | --------------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------------------- | | `AGManager:admin` | AG Manager | Discover and interact with modules, scripts, and playbooks sourced from Gateway. Required to view Gateway-sourced content. | | `cloud:config:read` | Itential Cloud Portal | View Itential Platform roles available for assignment. | | `cloud:config:write` | Itential Cloud Portal | Add, remove, and update Itential Platform roles. | | `cloud:directconnect:admin` | Direct Connect | Connect to Gateway instances from Itential Platform. Required to view Gateway-sourced content. | | `cloud:encrypt:read` | App-Encrypt | Use encryption features in Itential Platform. | | `datasets:delete` | Data Sets | Delete a data set export. | | `datasets:read` | Data Sets | View and search data set exports. | | `datasets:write` | Data Sets | Create a data set export. | | `search:read` | System Search | Search for resources using the System Search feature. | | `tags:assign` | Multiple | Assign tags to resources. | | `workcenter:write` | Work Center | Access Work Center and act on manual tasks in your queue. | ### NSO Manager | Role | Description | | ----------------------- | ----------------------------------------- | | `nso:cdb:admin` | Set items in NACM groups. | | `nso:cdb:read` | Execute REST queries. | | `nso:cdb:write` | Set leaf values and execute REST actions. | | `nso:commitqueue:read` | View the commit queue. | | `nso:commitqueue:write` | Edit the commit queue. | | `nso:devices:read` | View devices. | | `nso:devices:write` | Run actions and commands on devices. | | `nso:groups:read` | View authorization groups. | | `nso:neds:read` | View NEDs. | ### Operations Manager and Workflow Engine | Role | Application | Description | | --------------------------- | -------------------------------------- | -------------------------------------------- | | `jobs:admin` | Operations Manager | Create, view, update, and delete job groups. | | `jobs:delete` | Operations Manager and Workflow Engine | Cancel jobs. | | `jobs:read` | Operations Manager and Workflow Engine | View jobs. | | `jobs:write` | Operations Manager and Workflow Engine | Create, start, and work jobs. | | `tasks:admin` | Operations Manager | Full control of any tasks. | | `tasks:read` | Operations Manager | View tasks. | | `tasks:work` | Operations Manager | Interact with actionable tasks. | | `workflows:engine:read` | Workflow Engine | View the status of Workflow Engine. | | `workflows:engine:write` | Workflow Engine | Activate and deactivate Workflow Engine. | | `workflows:triggers:delete` | Operations Manager | Delete triggers. | | `workflows:triggers:read` | Operations Manager | View triggers. | | `workflows:triggers:write` | Operations Manager | Create and edit triggers. | ### Service Catalog and Service Catalog Builder | Role | Application | Description | | --------------------------- | ----------------------- | --------------------------------- | | `services:instances:delete` | Service Catalog Builder | Delete services. | | `services:instances:order` | Service Catalog | Create and invoke service orders. | | `services:instances:read` | Service Catalog | View services. | | `services:instances:write` | Service Catalog Builder | Create and edit services. | | `services:models:delete` | Service Catalog | Delete service models. | | `services:models:read` | Service Catalog | View service models. | | `services:models:write` | Service Catalog | Create and edit service models. | ### Studio | Role | Description | | ------------------------ | --------------------------------------- | | `forms:admin` | Create, update, and delete form groups. | | `forms:delete` | Delete forms. | | `forms:read` | View forms. | | `forms:write` | Create and edit forms. | | `mops:delete` | Delete command templates. | | `mops:read` | View command templates. | | `mops:run` | Execute command templates. | | `mops:write` | Create and edit command templates. | | `templates:delete` | Delete templates. | | `templates:read` | View templates. | | `templates:write` | Create and edit templates. | | `transformations:delete` | Delete transformations. | | `transformations:read` | View transformations. | | `transformations:write` | Create and edit transformations. | | `workflows:admin` | Full control of workflows. | | `workflows:delete` | Delete workflows. | | `workflows:read` | View workflows. | | `workflows:write` | Create and edit workflows. | > Complete reference of all roles available for assignment in Itential Cloud, organized by product and application.