Roles & capabilities reference
A quick reference table of every Cloud Control role and the capabilities it grants — Viewer, Deployer, SRE · Cloud Admin, Org Admin, Owner and platform admin.
A condensed reference. For the full explanation and enforcement rules, see the Roles & permissions guide.
Capability matrix
| Role | read | mutate_infra | manage_cloud_accounts | manage_users_sso | manage_billing_transfer |
|---|---|---|---|---|---|
| Viewer | ✅ | — | — | — | — |
| Deployer | ✅ | ✅ | — | — | — |
| SRE · Cloud Admin | ✅ | ✅ | ✅ | — | — |
| Org Admin | ✅ | ✅ | ✅ | ✅ | — |
| Owner | ✅ | ✅ | ✅ | ✅ | ✅ |
| Platform admin | ✅ | ✅ | ✅ | ✅ | ✅ (+ all orgs) |
What each capability unlocks
| Capability | Representative routes |
|---|---|
read | All GET reads: /api/console/data, /api/cloud/resources, /api/finops/cost, /api/audit, /api/org/users. |
mutate_infra | POST /api/finops/budgets, plan/apply and pipeline actions. |
manage_cloud_accounts | POST/DELETE /api/cloud/accounts…, …/validate, …/sync, POST /api/finops/ingest. |
manage_users_sso | POST/PATCH/DELETE /api/org/users…, /api/org/sso, org-wide /api/org/tokens. |
manage_billing_transfer | POST /api/org/transfer-ownership, billing. |
Tokens are capped
An API token's role is a ceiling and never confers owner or platform powers. See API tokens.