Permissions catalog¶
Generated from the architecture model
This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.
Roles are the seven of D18 and ADR-0015. A role listed on a screen may open it; what the role may do is decided per command by the owning platform (the BFF forwards with the user's token and scope). A missing role sees neither the screen nor its navigation entry.
| Screen | Requester | Reviewer | AssetMaintainer | Operator | WorkspaceAdmin | PlatformAdmin | Observer | Commands |
|---|---|---|---|---|---|---|---|---|
my-work |
● | ● | ● | ● | ● | ● | ● | SetStudioScope |
run-submit |
● | SubmitRun |
||||||
run-detail |
● | ● | ● | ● | CancelRun |
|||
approvals-list |
● | ● | ● | — | ||||
approval-card |
● | DecideApproval |
||||||
project-overview |
● | ● | ● | ● | ● | — | ||
project-settings |
● | SetMembership, Delegate, RevokeDelegation, SetSourceScope, SetProjectBudget |
||||||
environment-board |
● | ● | ● | CreateEnvironment, FreezeEnvironment, UnfreezeEnvironment |
||||
asset-catalog |
● | ● | ● | ● | ● | — | ||
release-detail |
● | ● | ● | ● | ValidateRelease, SubmitRelease, PublishRelease, DeprecateRelease, MoveAlias |
|||
agent-card |
● | ● | ● | — | ||||
tool-descriptor |
● | ● | ● | DryRunTool |
||||
mcp-servers |
● | ● | ● | RegisterMcpServer, DiscoverMcpCapabilities, ActivateMcpServer, RetireMcpServer |
||||
model-profiles |
● | ● | ● | RegisterDeployment, EvaluateDeployment, ApproveDeployment |
||||
workflow-definitions |
● | ● | ● | ValidateWorkflowDefinition |
||||
template-catalog |
● | ● | ● | DiscoverTemplates, PublishTemplateVersion |
||||
marketplace-browse |
● | ● | ● | ● | InstallListing, AcquireListing |
|||
marketplace-installations |
● | ● | ● | RemoveInstallation |
||||
publisher-console |
● | ● | CreateListing, SubmitListing, SetPricing, ApplyAsPublisher |
|||||
knowledge-sources |
● | ● | ● | RegisterSource, SyncSource, DeleteSource, SetCollection |
||||
knowledge-search |
● | ● | ● | — | ||||
memory |
● | ● | ● | ● | PromoteMemory, ArchiveMemory, SetMemoryConsent |
|||
repository-intelligence |
● | ● | ● | RebuildRepositoryIndexes |
||||
context-snapshot |
● | ● | ● | — | ||||
artifacts |
● | ● | ● | ● | ExportArtifacts |
|||
evaluation-runs |
● | ● | ● | ● | StartEvaluation, WaiveEvaluation |
|||
release-evidence |
● | ● | ● | — | ||||
feedback |
● | ● | ● | RecordFeedback |
||||
datasets |
● | ● | SnapshotDataset |
|||||
learning-proposals |
● | DecideLearningProposal |
||||||
product-releases |
● | ● | ● | CreateProductRelease, WithdrawProductRelease |
||||
run-list |
● | ● | ● | ● | RebuildRunProjection |
|||
run-timeline |
● | ● | ● | ● | — | |||
overview |
● | ● | ● | — | ||||
status-objectives |
● | ● | ● | ● | SetSlo |
|||
alerts |
● | ● | ● | ● | AcknowledgeAlert, ResolveAlert, SetAlertRule |
|||
usage-cost |
● | ● | ● | SetProjectBudget |
||||
capacity |
● | ● | ● | ● | SetWorkerPool, SetQuota, DrainComputePool |
|||
fleet-board |
● | ● | ● | — | ||||
product |
● | ● | ● | OnboardProduct, SetProductObjective |
||||
rollouts |
● | ● | ● | ● | PlanRollout, ResumeRollout, RollbackRollout, CancelRollout |
|||
incidents |
● | ● | OpenIncident, TransitionIncident |
|||||
on-call |
● | ● | SetOnCall |
|||||
offboardings |
● | ● | ● | RequestOffboarding, AcknowledgeHandover |
||||
policies |
● | ● | ● | ValidateProjectPolicy, SimulatePolicy |
||||
approval-policy |
● | ● | ● | ValidateProjectApprovalRules |
||||
audit |
● | ● | ● | ExportAudit |
||||
findings |
● | ● | ● | ResolveFinding, SetClassification |
||||
secrets-references |
● | ● | RegisterSecretReference, RotateSecret, RevokeSecretReference |
|||||
connections |
● | ● | ● | RegisterConnection, VerifyConnection, SetGrant, RotateCredential, RevokeConnection |
||||
connectors |
● | ● | ● | CertifyConnector, CreateSubscription, ReplayDelivery |
||||
topic-registry |
● | ● | ● | — | ||||
stores |
● | ● | ● | — | ||||
retention-residency |
● | ● | SetRetentionRule, SetResidency |
|||||
governance-orders |
● | ● | ● | IssueGovernanceOrder |
||||
users-roles |
● | ● | SetMembership, Delegate, RevokeDelegation |
|||||
editions-billing |
● | ● | ChangeSubscription |
|||||
notification-preferences |
● | ● | ● | ● | ● | ● | ● | SetNotificationPreferences, SetStudioPreferences |
blueprints |
● | ● | ● | CreateBlueprintVersion, ValidateBlueprint, SubmitBlueprint |
||||
dsl-studio |
● | ● | ValidateBlueprint |
|||||
recipes |
● | ● | ● | ● | DraftRecipe, ValidateRecipe, ApproveRecipe |
|||
generated-outputs |
● | ● | ● | ● | — | |||
proposals |
● | ● | ● | ● | — | |||
pipeline-runs |
● | ● | ● | ● | ReconcilePipelineRun |
|||
promotions |
● | ● | ● | ● | RequestPromotion, RollbackPromotion |
|||
provisioning |
● | ● | ● | PlanProvisioning, CancelProvisioning |
||||
inventory |
● | ● | ● | ObserveEnvironment, DecideReconciliation |
||||
generated-products |
● | ● | ● | AcknowledgeOperationsHandover |
||||
workflow-run-graph |
● | ● | ● | Runtime.Interrupt, Runtime.AnswerDecision |