Roles & permissions
The complete Cloud Control role and capability model: Viewer, Deployer, SRE · Cloud Admin, Org Admin, Owner and platform admin, and exactly what each one can do.
Cloud Control uses a fixed role-to-capability model. A role is a named bundle of capabilities; the server enforces capabilities on every mutating route, and the console hides exactly what a role cannot do — both from one shared source of truth.
Capabilities
| Capability | Grants |
|---|---|
read | View every screen: dashboard, inventory, topology, cost, audit, team roster. |
mutate_infra | Infrastructure actions — plan/apply drawer, pipeline promotions, creating budgets. |
manage_cloud_accounts | Connect, verify, sync and disconnect cloud accounts; trigger cost ingestion. |
manage_users_sso | Manage team members, SSO configuration, and org-wide API tokens. |
manage_billing_transfer | Billing and organization ownership transfer — the owner only. |
The role matrix
| Role | read | mutate_infra | manage_cloud_accounts | manage_users_sso | manage_billing_transfer |
|---|---|---|---|---|---|
| Viewer | ✅ | — | — | — | — |
| Deployer | ✅ | ✅ | — | — | — |
| SRE · Cloud Admin | ✅ | ✅ | ✅ | — | — |
| Org Admin | ✅ | ✅ | ✅ | ✅ | — |
| Owner | ✅ | ✅ | ✅ | ✅ | ✅ |
| Platform admin | ✅ | ✅ | ✅ | ✅ | ✅ (+ fleet admin) |
The Owner is an Org Admin plus manage_billing_transfer; there is exactly one owner per organization. A platform admin is the deployment operator — it implies every capability and additionally administers all organizations through the admin API. 'Platform Owner' is not an assignable org role.
How enforcement works
- Capabilities are recomputed per request from the database role, so a downgrade takes effect on the next request without re-login.
- A denied mutation on a member-visible surface returns an honest
403and is audited; a hidden surface (platform admin) returns404. - Cross-organization identifiers always return
404— no existence leak. - The capability set rides `GET /api/auth/me`, so the UI and the API agree on what you can do.
An API token carries a role as its capability ceiling and never owner or platform powers — even if the human who created it is the owner. A token's role can never exceed its creator's own capabilities.
Roadmap
Per-account and per-project scoping (RBAC-09) and a break-glass flow (RBAC-11) are on the roadmap; today roles apply org-wide.