---
title: Roles and permissions
slug: roles-and-permissions
docTags: 
createdAt: 2026-04-29T13:59:52.669Z
---

Kyndryl Bridge services permissions enable Administrators to select specific permissions used to create custom roles, allowing users to have designated actions and permissions for specific services based on the authorization model.

# System settings

System permissions control access to service broker repositories, service broker settings and issue management capabilities. These permissions allow administrators to view, create, update and delete service broker configurations and support issues as needed.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>     | <font color="#f3f4f6">**Roles related to**</font> |
| ------------------------------------------------ | ------------------------------------------------ | ------------------------------------------------- |
| feedback.brokers-repos.view                      | Allow to view service broker repos               | Administrator                                     |
| feedback.brokers-settings.create                 | Allow to create service broker settings          | Administrator                                     |
| feedback.brokers-settings.delete                 | Allow to delete existing service broker settings | Administrator                                     |
| feedback.brokers-settings.update                 | Allow to update existing service broker settings | Administrator                                     |
| feedback.brokers-settings.view                   | Allow to view service broker settings            | Administrator                                     |
| feedback.issues.create                           | Allow to create issue                            | Administrator                                     |
| feedback.issues.delete                           | Allow to delete existing issue                   | Administrator                                     |
| feedback.issues.update                           | Allow to update existing issue                   | Administrator                                     |
| feedback.issues.view                             | Allow to view issues                             | Administrator                                     |



# Bridge Access Management

## User invitations

Organization Management permissions control access to organization and invitation management capabilities. These permissions allow users to create and view organizations, invite and manage users, resend or update invitations, reinvite account owners and perform administrative actions based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font> |
| ------------------------------------------------ | -------------------------------------------- | ------------------------------------------------- |
| accounts.user.reinvite                           | Allow to reinvite the account initial user   | - Administrator<br />- Editor                     |
| iam.invitations.create                           | Allow to create invitations                  | Administrator                                     |
| iam.invitations.delete                           | Allow to delete invitations                  | - Administrator<br />- Editor                     |
| iam.invitations.resend                           | Allow to resend pending invitations          | - Administrator<br />- Editor                     |
| iam.invitations.update                           | Allow to update invitations                  | - Administrator<br />- Editor                     |
| iam.invitations.view                             | Allow to view invitations                    | - Administrator<br />- Editor                     |
| iam.organization.bulkdelete                      | Allow to delete multiple organizations       | - Administrator<br />- Editor                     |
| iam.organization.create                          | Allow to create new organization             | - Administrator<br />- Operator<br />- Viewer     |
| iam.organization.invite                          | Allow to invite new user to an organization  | - Administrator<br />- Editor                     |
| iam.organization.view                            | Allow to view an organization                | - Administrator<br />- Editor                     |

## Resources and users

Resources and users permissions control access to resource, resource group, user group and user management capabilities. These permissions allow users to view resource-related information and manage users, user mappings and user lifecycle operations based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>       | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- |
| iam.resourceattributes.view                      | Allow to view resources                            | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.resourceattributesvalues.view                | Allow to view resources attribute values           | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.resourcegroups.view                          | Allow to view resource groups                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.usergroups.view                              | Allow to view user groups                          | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.usermapping.update                           | Allow to update user mapping assertions            | - Administrator<br />- Editor                               |
| iam.users-lastoperation.view                     | Allow to view last operation performed for an user | - Administrator<br />- Editor                               |
| iam.users.bulkdelete                             | Allow to delete multiple users                     | - Administrator<br />- Editor                               |
| iam.users.create                                 | Allow to create the users                          | Administrator                                               |
| iam.users.delete                                 | Allow to delete the users                          | - Administrator<br />- Editor                               |
| iam.users.update                                 | Allow to update the users                          | - Administrator<br />- Editor                               |
| iam.users.view                                   | Allow to view the users                            | - Administrator<br />- Editor                               |

## Account, roles and permissions

These permissions govern access to account administration, role management, broker configuration and related resources. These permissions enable users to create, modify, view, and manage accounts, custom roles, brokers, catalogs and business services based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>                       | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | ------------------------------------------------------------------ | ----------------------------------------------------------- |
| fileserver.files.view                            | Allow to view files                                                | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.accounts.create                              | Allow to create a new account                                      | Administration                                              |
| iam.accounts.delete                              | Allow to delete accounts                                           | - Administrator<br />- Editor                               |
| iam.accounts.update                              | Allow to update an account                                         | - Administrator<br />- Editor                               |
| iam.accounts.revoke                              | Allow to revoke one or more user access from the logged in account | - Administrator                                             |
| iam.accounts.view                                | Allow to view accounts                                             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.brokers.delete                               | Allow to delete broker                                             | - Administrator<br />- Editor                               |
| iam.brokers.register                             | Allow to register new broker                                       | - Administrator<br />- Editor                               |
| iam.brokers.test                                 | Allow to test brokers                                              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.brokers.view                                 | Allow to view brokers                                              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.businessservices.view                        | Allow to view business services                                    | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.catalogs.view                                | Allow to view catalogs                                             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.customrole.create                            | Allow to create a custom role                                      | Administrator                                               |
| iam.customrole.delete                            | Allow to delete a custom role                                      | - Administrator<br />- Editor                               |
| iam.customrole.update                            | Allow to update a custom role                                      | - Administrator<br />- Editor                               |
| iam.customrole.view                              | Allow to view custom roles                                         | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

## Service IDs

Service ID permissions control access to Service ID management capabilities. These permissions allow users to create, update, delete and view Service IDs used for authentication and service-to-service interactions, based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| iam.serviceids.create                            | Allow to create serviceids                   | Administrator                                               |
| iam.serviceids.delete                            | Allow to delete serviceids                   | - Administrator<br />- Editor                               |
| iam.serviceids.update                            | Allow to update serviceids                   | - Administrator<br />- Editor                               |
| iam.serviceids.view                              | Allow to view serviceids                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

## SMTP

SMTP permissions control access to email configuration and SAML service provider metadata. These permissions allow users to manage SMTP settings for email communications and view SAML SP metadata required for identity federation and authentication, based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| iam.smtp.create                                  | Allow to create smtp config                  | Administrator                                               |
| iam.smtp.delete                                  | Allow to delete smtp config                  | - Administrator<br />- Editor                               |
| iam.smtp.view                                    | Allow to view smtp config                    | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.spmetadata.view                              | Allow to view SAML SP metadata               | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

## IdP

IdP (Identity Provider) permissions control access to identity provider configuration and federation settings. These permissions allow users to view metadata, create, update, delete and manage identity providers used for authentication and single sign-on (SSO), based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>    | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | ----------------------------------------------- | ----------------------------------------------------------- |
| iam.idp-metadata.view                            | Allow to view identity provider metadata        | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.idp.create                                   | Allow to create identity provider               | Administrator                                               |
| iam.idp.delete                                   | Allow to delete identity provider               | - Administrator<br />- Editor                               |
| iam.idp.replace                                  | Allow to replace fields of an identity provider | - Administrator<br />- Editor                               |
| iam.idp.update                                   | Allow to update an identity provider            | - Administrator<br />- Editor                               |
| iam.idp.view                                     | Allow to view an identity provider              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

## API keys, key values and tokens

These permissions control access to authentication credentials and configuration data used across the platform. These permissions allow users to create, manage, update, delete and view API keys, tokens, and key-value pairs based on their assigned role, supporting secure access and service integration.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| iam.apikeys.create                               | Allow to create api keys                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.apikeys.delete                               | Allow to delete existing api keys            | - Administrator<br />- Editor<br />- Operator               |
| iam.apikeys.manage                               | Allow to manage api keys                     | - Administrator<br />- Editor                               |
| iam.apikeys.replace                              | Allow to replace existing api keys           | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.apikeys.update                               | Allow to patch existing api keys             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.apikeys.view                                 | Allow to view api keys                       | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.tokens.create                                | Allow to create a token                      | Administrator                                               |
| iam.tokens.delete                                | Allow to delete a token                      | - Administrator<br />- Editor                               |
| iam.tokens.replace                               | Allow to replace a token                     | - Administrator<br />- Editor                               |
| iam.tokens.update                                | Allow to update a token                      | - Administrator<br />- Editor                               |
| iam.tokens.view                                  | Allow to view tokens                         | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.keyvalues.create                             | Allow to add key-value                       | Administrator                                               |
| iam.keyvalues.delete                             | Allow to delete key-value                    | - Administrator<br />- Editor                               |
| iam.keyvalues.update                             | Allow to update key-value                    | - Administrator<br />- Editor                               |
| iam.keyvalues.view                               | Allow to view key-value                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

## Access tags

Access Tags permissions control access to the management of access tags used to organize and govern access across the platform. These permissions allow users to create, update, delete and view access tags based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| iam.accesstags.create                            | Allow to add accesstags                      | Administrator                                               |
| iam.accesstags.delete                            | Allow to delete accesstags                   | - Administrator<br />- Editor                               |
| iam.accesstags.update                            | Allow to update accesstags                   | - Administrator<br />- Editor<br />- Operator               |
| iam.accesstags.view                              | Allow to view accesstags                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| iam.accesstags.create                            | Allow to add accesstags                      | Administrator                                               |
| iam.accesstags.delete                            | Allow to delete accesstags                   | - Administrator<br />- Editor                               |
| iam.accesstags.update                            | Allow to update accesstags                   | - Administrator<br />- Editor<br />- Operator               |
| iam.accesstags.view                              | Allow to view accesstags                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

## Access groups and access policies

Access Groups and Access Policies permissions control the management of access groups, group membership, access rules and authorization policies. These permissions allow users to create, modify, delete and view access groups and policies, manage group members and rules and control access governance based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| iam.accessgroups-members.add                     | Allow to add members to access group         | - Administrator<br />- Editor                               |
| iam.accessgroups-members.delete                  | Allow to delete accessgroup member           | - Administrator<br />- Editor                               |
| iam.accessgroups-members.view                    | Allow to view access group members           | - Administrator<br />- Editor                               |
| iam.accessgroups-rules.add                       | Allow to add rules to access group           | - Administrator<br />- Editor                               |
| iam.accessgroups-rules.delete                    | Allow to delete access group rules           | - Administrator<br />- Editor                               |
| iam.accessgroups-rules.view                      | Allow to view access group rules             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.accessgroups.create                          | Allow to create accessgroup                  | Administrator                                               |
| iam.accessgroups.delete                          | Allow to delete accessgroup                  | - Administrator<br />- Editor                               |
| iam.accessgroups.update                          | Allow to update access group                 | - Administrator<br />- Editor<br />- Operator               |
| iam.accessgroups.view                            | Allow to view access groups                  | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.authzpolicy.create                           | Allow to create new authorization policies   | Administrator                                               |
| iam.authzpolicy.delete                           | Allow to delete authorization policies       | - Administrator<br />- Editor                               |
| iam.authzpolicy.update                           | Allow to update authorization policies       | - Administrator<br />- Editor                               |
| iam.authzpolicy.view                             | Allow to view authorization policies         | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.policies.view                                | Allow to view policies                       | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

# Connections, Notifications and Metering

These permissions control access to connection management, notification configuration, and usage monitoring capabilities. These permissions allow users to create, test, update and view connections; manage notification settings, templates and in-app notifications; and access metering data, usage reports and tenant consumption details based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>            | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | ------------------------------------------------------- | ----------------------------------------------------------- |
| iam.connections.create                           | Allow to create connections                             | Administrator                                               |
| iam.connections.delete                           | Allow to delete connections                             | - Administrator<br />- Editor                               |
| iam.connections.test                             | Allow to test connections                               | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.connections.update                           | Allow to update connections                             | - Administrator<br />- Editor                               |
| iam.connections.view                             | Allow to view connections                               | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.brokersusage.view                       | Allow to view service broker usage                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.meter.view                              | Allow to view metering details                          | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.resetcosa.create                        | Allow to reset cosa state                               | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.tenantmeter.view                        | Allow to view tenant specific metering details          | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.tenantsusage.view                       | Allow to view tenant specific metering usage            | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.usage.download                          | Allow to download metering data                         | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| metering.usage.view                              | Allow to view metering usage                            | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.emailsettings.create                | Allow to create notification emailsettings              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.emailsettings.delete                | Allow to delete notification emailsettings              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.emailsettings.update                | Allow to update notification emailsettings              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.emailsettings.view                  | Allow to view notification emailsettings                | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.inapp.create                        | Allow to create inapp notification                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.inapp.delete                        | Allow to delete inapp notification                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.inapp.update                        | Allow to update inapp notification                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.inapp.view                          | Allow to view inapp notification                        | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.template.create                     | Allow to create notification template                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.template.delete                     | Allow to delete notification template                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.template.put                        | Allow to put notification template                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.template.update                     | Allow to update notification template                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| notification.template.view                       | Allow to view notification template                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| security.connections.create                      | Allow to create connections                             | - Administrator<br />- Operator                             |
| security.connections.delete                      | Allow to delete connections                             | - Administrator<br />- Editor<br />- Operator               |
| security.connections.link                        | Allow to link shared connections                        | - Administrator<br />- Editor<br />- Operator               |
| security.connections.replace                     | Allow to replace connections                            | - Administrator<br />- Editor<br />- Operator               |
| security.connections.test                        | Allow to test connections                               | - Administrator<br />- Editor<br />- Operator               |
| security.connections.update                      | Allow to update connections                             | - Administrator<br />- Editor<br />- Operator               |
| security.connections.view                        | Allow to view connections                               | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| security.connectionstatus.view                   | Allow to get test connection status                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| security.connectiontypes.create                  | Allow to add/update connectiontypes for a client tenant | Administrator                                               |
| security.connectiontypes.delete                  | Allow to delete connection types for a client tenant    | - Administrator<br />- Editor                               |
| security.connectiontypes.view                    | Allow to view connectiontypes for a client tenant       | - Administrator<br />- Editor                               |

# Tenant settings

Tenant Settings permissions control access to tenant administration, configuration, identity management, invitations, entitlements and operational settings. These permissions allow users to manage tenant properties, roles, identity providers, OIDC applications, invitations, feature flags and other tenant-level resources, while also providing visibility into tenant activity, settings and configuration details based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>                      | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | ----------------------------------------------------------------- | ----------------------------------------------------------- |
| iam.tenant-activitylogs.view                     | Allow to view activity logs for a tenant                          | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.tenant-entitlements.update                   | Allow to update tenant entitlements                               | - Administrator<br />- Editor                               |
| iam.tenant-entitlements.view                     | Allow to view tenant entitlements                                 | - Administrator<br />- Editor                               |
| iam.tenant-membership.add                        | Allow to add the tenant level roles of the users                  | - Administrator<br />- Editor                               |
| iam.tenant-membership.remove                     | Allow to remove the tenant level roles of the users               | - Administrator<br />- Editor                               |
| iam.tenant-opssettings.view                      | Get Ops Settings                                                  | - Administrator<br />- Editor                               |
| iam.tenant-owner.update                          | Allow to update tenant owner                                      | - Administrator<br />- Editor                               |
| iam.tenant-settings.update                       | Allow to update tenant settings                                   | - Administrator<br />- Editor                               |
| iam.tenant-settings.view                         | Allow to view tenant settings                                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.tenant.bindinginfo.view                      | Allow to view binding info                                        | - Administrator<br />- Editor                               |
| iam.tenant.create                                | Allow to create new tenant                                        | Administrator                                               |
| iam.tenant.delete                                | Allow to delete a tenant                                          | - Administrator<br />- Editor                               |
| iam.tenant.modify                                | Allow to modify a tenant                                          | - Administrator<br />- Editor                               |
| iam.tenant.update                                | Allow to update a tenant                                          | - Administrator<br />- Editor                               |
| iam.tenant.view                                  | Allow to view tenants                                             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.tenantidp.create                             | Allow to create tenant manager level identity provider            | Administrator                                               |
| iam.tenantidp.delete                             | Allow to delete tenant manager level identity provider            | - Administrator<br />- Editor                               |
| iam.tenantidp.replace                            | Allow to replace fields of tenant manager level identity provider | - Administrator<br />- Editor                               |
| iam.tenantidp.update                             | Allow to update fields of tenant manager level identity provider  | - Administrator<br />- Editor                               |
| iam.tenantidp.view                               | Allow to view tenant manager level identity provider              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.tenants-globalfeatureflags.update            | Allow to update tenant featureflags                               | - Administrator<br />- Editor                               |
| iam.tenants-opssettings.update                   | Allow to update tenant opssettings                                | - Administrator<br />- Editor                               |
| iam.tenants-opssettings.view                     | Allow to view tenant opssettings                                  | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.tm-invitations.create                        | Allow to create tenant manager level invitations                  | Administrator                                               |
| iam.tm-invitations.delete                        | Allow to delete tenant manager level invitations                  | - Administrator<br />- Editor                               |
| iam.tm-invitations.update                        | Allow to update tenant manager invitations                        | - Administrator<br />- Editor                               |
| iam.tm-invitations.view                          | Allow to view tenant manager level invitations                    | - Administrator<br />- Editor                               |
| iam.dcphost.view                                 | Allow to retrive the dcp base host based on region                | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.delegatedtoken.create                        | Allow to create delegated token                                   | Administrator                                               |
| iam.dns.view                                     | Allow to view dns                                                 | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.domains.view                                 | Allow to view domains                                             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.globalidp.view                               | Allow to view global identity providers                           | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| iam.identity.unlink                              | Allow to unlink the user identity                                 | - Administrator<br />- Editor                               |
| iam.oidcapp.create                               | Allow to create OIDC application                                  | Administrator                                               |
| iam.oidcapp.delete                               | Allow to delete OIDC application                                  | - Administrator<br />- Editor                               |
| iam.oidcapp.replace                              | Allow to replace OIDC application                                 | - Administrator<br />- Editor                               |
| iam.oidcapp.update                               | Allow to update OIDC application                                  | - Administrator<br />- Editor                               |
| iam.oidcapp.view                                 | Allow to view OIDC application                                    | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

# Audit

Audit permissions control access to audit records and audit management capabilities. These permissions allow users to view, download and manage audit information, providing visibility into system activities and supporting compliance, governance and operational monitoring based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| audit.records.download                           | Allow to download audit records              | - Administrator<br />- Editor                               |
| audit.records.view                               | Allow to view audit records                  | - Administrator<br />- Editor                               |
| iam.audit.delete                                 | Allow to delete audit                        | - Administrator<br />- Editor                               |
| iam.audit.replace                                | Allow to replace audit                       | - Administrator<br />- Editor                               |
| iam.audit.view                                   | Allow to view audit                          | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

# Security

Security permissions control access to connection management, Vault configuration, and connection metadata. These permissions allow users to create, update, test, view and delete secure connections, manage Vault configurations through APIs and access connection metadata required for secure integration and credential management based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font> |
| ------------------------------------------------ | -------------------------------------------- | ------------------------------------------------- |
| security.connections.create                      | Allow to create connections                  | Administrator                                     |
| security.connections.delete                      | Allow to delete connections                  | Administrator                                     |
| security.connections.update                      | Allow to update connections                  | Administrator                                     |
| security.connections.view                        |                                              | Administrator<br />Viewer                         |
| security.connections.test                        | Allow to test connections                    | Administrator<br />Viewer                         |
| security.vaultconfig.create                      | Allow to create Vault Config \[Only API]     | Administrator                                     |
| security.vaultconfig.delete                      | Allow to delete Vault Config \[Only API]     | Administrator                                     |
| security.vaultconfig.view                        | Allow to view Vault Config \[Only API]       | Administrator                                     |
| security.connectionstypes.view                   | Allow to view connections metadata           | Viewer                                            |

# Discovery Management

Discovery Management permissions control access to inventory resources, discovery records, actions, locations, categories and tags. These permissions allow users to view discovery data, execute and manage actions, access inventory information and manage resource tags, based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>           | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | ------------------------------------------------------ | ----------------------------------------------------------- |
| common-discovery.account.view                    | Allow to view inventory accounts                       | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| common-discovery.actions.admin                   | Allow to onboard actions                               | Administrator                                               |
| common-discovery.actions.execute                 | Allow to execute actions                               | - Administrator<br />- Operator                             |
| common-discovery.actions.view                    | Allow to view inventory actions                        | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| common-discovery.category.view                   | Allow to view inventory records' category              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| common-discovery.location.view                   | Allow to view inventory records' location              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| common-discovery.service.view                    | Allow to view inventory records                        | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| common-discovery.tags.edit                       | Allow to edit/add/delete inventory resources tags      | - Administrator<br />- Editor                               |
| common-discovery.tags.view                       | Allow to view import tags jobs for inventory resources | - Administrator<br />- Editor                               |

# Actions

**T**hese permission**s&#x20;**&#x63;ontrol access to the Action Registry and action management capabilities. These permissions allow users to view, create, update and manage action categories, definitions, providers, policies, requests, statistics, support resources and action types, as well as onboard and administer actions based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>                  | <font color="#f3f4f6">**Roles related to**</font>                                                             |
| ------------------------------------------------ | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| actions.action\_category.view                    | Allow to perform view operation on action category            | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_definition.view                  | Allow to perform view operation on action definition          | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_policy.view                      | Allow to perform view operation on action policy              | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_provider.view                    | Allow to perform view operation on action provider            | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_request.view                     | Allow to perform view operation on action request             | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_stats.view                       | Allow to perform view operation on action stats               | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_support.view                     | Allow to perform view operation on action support             | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_types.view                       | Allow to perform view operation on action type                | - Administrator<br />- Editor<br />- Operator<br />- Viewer<br />- Action viewer<br />- Action Registry Admin |
| actions.action\_category.crud                    | Allow to perform crud operation on action category            | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_definition.crud                  | Allow to perform crud operation on action definition          | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_engine\_api\_manager.crud        | Allow to perform crud operation on action enginer api manager | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_engine\_practitioner.crud        | Allow to perform crud operation on action engine practitioner | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_onboarding.crud                  | Allow to perform crud operation on action onboarding          | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_policy.crud                      | Allow to perform crud operation on action policy              | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_provider.crud                    | Allow to perform crud operation on action provider            | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_request.crud                     | Allow to perform crud operation on action request             | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_stats.crud                       | Allow to perform crud operation on action stats               | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_support.crud                     | Allow to perform crud operation on action support             | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |
| actions.action\_types.crud                       | Allow to perform crud operation on action types               | - Administrator<br />- Editor<br />- Action Registry Admin                                                    |

# Topology

Topology permissions control access to topology, impact analysis, metadata and tag information. These permissions allow users to view resource relationships, dependency mappings, impact analysis data, topology metadata and associated tags, helping them understand and analyze the structure and connections of managed resources based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font> | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------- | ----------------------------------------------------------- |
| topology.impactanalysis-data.view                | Allow to view impactanalysis                 | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| topology.topology-data.view                      | Allow to view topology data                  | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| topology.topology-metadata.view                  | Allow to view topology metadata              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| topology.topology-tags.view                      | Allow to view topology tags                  | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

# Container Cluster Management&#x20;

Container Cluster Management control access to cluster monitoring, discovery, insights, custom views, geolocation data, metrics, alerts, logs and Kubernetes resource management. These permissions allow users to view cluster health and performance information, manage Kubernetes resources, access operational insights and administer containerized workloads across managed clusters based on their assigned role.

| <font color="#f3f4f6">**Permission name**</font> | <font color="#f3f4f6">**Description**</font>                   | <font color="#f3f4f6">**Roles related to**</font>           |
| ------------------------------------------------ | -------------------------------------------------------------- | ----------------------------------------------------------- |
| ccm.cluster-alerts.view                          | Allow to view alerts of a cluster                              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.cluster-data.view                            | Allow to view cluster data                                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.cluster.view                                 | Allow to view cluster                                          | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.clusters-alerts.view                         | Allow to view alerts of all clusters                           | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.clusters.view                                | Allow to view clusters                                         | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.custom-views.create                          | Allow to create custom views                                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.custom-views.delete                          | Allow to delete custom views                                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.custom-views.update                          | Allow to update custom views                                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.custom-views.view                            | Allow to view custom views                                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.discovery-clusters.view                      | Allow to view discovery clusters                               | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.geo-locations.delete                         | Allow to delete geographical locations for clusters            | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.geo-locations.edit                           | Allow to edit geographical locations for clusters              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.geo-locations.view                           | Allow to view geographical locations for clusters              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.geolocation-aggregates.view                  | Allow to view cluster geolocation aggregates                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.insights-recommendations.view                | Allow to view Insights recommendations                         | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.kubernetes-clusterrole.create                | Allow to create Kubernetes resource - ClusterRole              | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-clusterrole.delete                | Allow to delete Kubernetes resource - ClusterRole              | Administrator                                               |
| ccm.kubernetes-clusterrolebinding.create         | Allow to create Kubernetes resource - ClusterRoleBinding       | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-clusterrolebinding.delete         | Allow to delete Kubernetes resource - ClusterRoleBinding       | Administrator                                               |
| ccm.kubernetes-configmap.create                  | Allow to create Kubernetes resource - ConfigMap                | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-configmap.delete                  | Allow to delete Kubernetes resource - ConfigMap                | Administrator                                               |
| ccm.kubernetes-cronjob.create                    | Allow to create Kubernetes resource - CronJob                  | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-cronjob.delete                    | Allow to delete Kubernetes resource - CronJob                  | Administrator                                               |
| ccm.kubernetes-customresourcedefinition.create   | Allow to create Kubernetes resource - CustomResourceDefinition | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-customresourcedefinition.delete   | Allow to delete Kubernetes resource - CustomResourceDefinition | Administrator                                               |
| ccm.kubernetes-daemonset.create                  | Allow to create Kubernetes resource - DaemonSet                | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-daemonset.delete                  | Allow to delete Kubernetes resource - DaemonSet                | Administrator                                               |
| ccm.kubernetes-deployment.create                 | Allow to create Kubernetes resource - Deployment               | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-deployment.delete                 | Allow to delete Kubernetes resource - Deployment               | Administrator                                               |
| ccm.kubernetes-endpoints.create                  | Allow to create Kubernetes resource - Endpoints                | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-endpoints.delete                  | Allow to delete Kubernetes resource - Endpoints                | Administrator                                               |
| ccm.kubernetes-endpointslice.create              | Allow to create Kubernetes resource - EndpointSlice            | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-endpointslice.delete              | Allow to delete Kubernetes resource - EndpointSlice            | Administrator                                               |
| ccm.kubernetes-horizontalpodautoscaler.create    | Allow to create Kubernetes resource - HorizontalPodAutoscaler  | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-horizontalpodautoscaler.delete    | Allow to delete Kubernetes resource - HorizontalPodAutoscaler  | Administrator                                               |
| ccm.kubernetes-ingress.create                    | Allow to create Kubernetes resource - Ingress                  | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-ingress.delete                    | Allow to delete Kubernetes resource - Ingress                  | Administrator                                               |
| ccm.kubernetes-job.create                        | Allow to create Kubernetes resource - Job                      | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-job.delete                        | Allow to delete Kubernetes resource - Job                      | Administrator                                               |
| ccm.kubernetes-limitrange.create                 | Allow to create Kubernetes resource - LimitRange               | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-limitrange.delete                 | Allow to delete Kubernetes resource - LimitRange               | Administrator                                               |
| ccm.kubernetes-namespace.create                  | Allow to create Kubernetes resource - Namespace                | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-namespace.delete                  | Allow to delete Kubernetes resource - Namespace                | Administrator                                               |
| ccm.kubernetes-networkpolicy.create              | Allow to create Kubernetes resource - NetworkPolicy            | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-networkpolicy.delete              | Allow to delete Kubernetes resource - NetworkPolicy            | Administrator                                               |
| ccm.kubernetes-persistentvolume.create           | Allow to create Kubernetes resource - PersistentVolume         | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-persistentvolume.delete           | Allow to delete Kubernetes resource - PersistentVolume         | Administrator                                               |
| ccm.kubernetes-persistentvolumeclaim.create      | Allow to create Kubernetes resource - PersistentVolumeClaim    | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-persistentvolumeclaim.delete      | Allow to delete Kubernetes resource - PersistentVolumeClaim    | Administrator                                               |
| ccm.kubernetes-pod.create                        | Allow to create Kubernetes resource - Pod                      | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-pod.delete                        | Allow to delete Kubernetes resource - Pod                      | Administrator                                               |
| ccm.kubernetes-poddisruptionbudget.create        | Allow to create Kubernetes resource - PodDisruptionBudget      | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-poddisruptionbudget.delete        | Allow to delete Kubernetes resource - PodDisruptionBudget      | Administrator                                               |
| ccm.kubernetes-priorityclass.create              | Allow to create Kubernetes resource - PriorityClass            | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-priorityclass.delete              | Allow to delete Kubernetes resource - PriorityClass            | Administrator                                               |
| ccm.kubernetes-replicaset.create                 | Allow to create Kubernetes resource - ReplicaSet               | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-replicaset.delete                 | Allow to delete Kubernetes resource - ReplicaSet               | Administrator                                               |
| ccm.kubernetes-resource-types.view               | Allow to view Kubernetes resource types list                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.kubernetes-resourcequota.create              | Allow to create Kubernetes resource - ResourceQuota            | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-resourcequota.delete              | Allow to delete Kubernetes resource - ResourceQuota            | Administrator                                               |
| ccm.kubernetes-role.create                       | Allow to create Kubernetes resource - Role                     | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-role.delete                       | Allow to delete Kubernetes resource - Role                     | Administrator                                               |
| ccm.kubernetes-rolebinding.create                | Allow to create Kubernetes resource - RoleBinding              | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-rolebinding.delete                | Allow to delete Kubernetes resource - RoleBinding              | Administrator                                               |
| ccm.kubernetes-secret.create                     | Allow to create Kubernetes resource - Secret                   | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-secret.delete                     | Allow to delete Kubernetes resource - Secret                   | Administrator                                               |
| ccm.kubernetes-service.create                    | Allow to create Kubernetes resource - Service                  | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-service.delete                    | Allow to delete Kubernetes resource - Service                  | Administrator                                               |
| ccm.kubernetes-serviceaccount.create             | Allow to create Kubernetes resource - ServiceAccount           | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-serviceaccount.delete             | Allow to delete Kubernetes resource - ServiceAccount           | Administrator                                               |
| ccm.kubernetes-statefulset.create                | Allow to create Kubernetes resource - StatefulSet              | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-statefulset.delete                | Allow to delete Kubernetes resource - StatefulSet              | Administrator                                               |
| ccm.kubernetes-storageclass.create               | Allow to create Kubernetes resource - StorageClass             | - Administrator<br />- Editor<br />- Operator               |
| ccm.kubernetes-storageclass.delete               | Allow to delete Kubernetes resource - StorageClass             | Administrator                                               |
| ccm.pod-logs.download                            | Allow to download pod logs                                     | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.prometheus-alerts.view                       | Allow to view cluster alerts                                   | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.prometheus-node-metrics.view                 | Allow to view cluster node-metrics                             | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.prometheus-pod-metrics.view                  | Allow to view cluster pod-metrics                              | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.prometheus-stats.view                        | Allow to view cluster stats                                    | - Administrator<br />- Editor<br />- Operator<br />- Viewer |
| ccm.provider-aggregates.view                     | Allow to view cluster provider aggregates                      | - Administrator<br />- Editor<br />- Operator<br />- Viewer |

# Feature flags

Feature Flags permissions control access to the creation and management of feature flags used to enable, disable and control platform functionality. These permissions allow users to create, view, enable, disable and delete feature flags based on their assigned platform role.

| ****<font color="#f3f4f6">**Permission name**</font>**** | ****<font color="#f3f4f6">**Description**</font>**** | ****<font color="#f3f4f6">**Roles Related**</font>****<font color="#f3f4f6"> **to**</font>**** |
| -------------------------------------------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| platform.featureflags.create                             | Allow to create feature flags                        | Platform Administrator                                                                         |
| platform.featureflags.delete                             | Allow to delete feature flags                        | Platform Administrator                                                                         |
| platform.featureflags.disable                            | Allow to disable feature flags                       | Platform Administrator                                                                         |
| platform.featureflags.enable                             | Allow to enable feature flags                        | Platform Administrator                                                                         |
| platform.featureflags.view                               | Allow to enable feature flags                        | Platform AdministratorPlatform Viewer                                                          |