User Management & Permissions

RBAC roles defined in Facets have a list of associated permissions that grant the user privileges to perform certain actions. This page provides a comprehensive overview of the permissions available within the system. You can find a comprehensive list of permissions listed below.

Common Permissions:

1. Read: Grants permission to see entities without changing them.
2. Write: Grants permission to create and edit entities.
3. Delete: Grants permission to delete entities.

These three build on each other: Read < Write < Delete. Holding Write implies Read, and holding Delete implies both. Revoking every read permission in a category hides that category from the user rather than showing it read-only, so the User Management card disappears for a user who holds none of its read permissions.

Read exists for five categories: Custom Role, Module, Resource Group, User, and User Group. Every other category has Write and Delete only, and seeing an entity there follows from holding one of those.

List of Permissions:

The table below categorizes permissions by their respective areas, detailing the capabilities granted under each category.

• Category: Represents the functional area or entity within the system.
• Write: Indicates whether write permission is available within the category.
• Delete: Indicates whether delete permission is available within the category.
• Read: Indicates whether read permission is available within the category.
• Special Permissions: Lists any additional specific permissions that provide more granular control over actions within the category.
• Permission Tokens: The raw identifiers the API, the CLI, and custom role definitions use. Pass one to raptor auth can-i PERMISSION to check whether you hold it, and list them under permissions when you define a custom role with raptor apply role.

Permissions are added as the platform grows, so treat this table as a reference rather than the definitive registry. Run raptor auth can-i with no argument for an overview of the permissions your own account currently holds.

AI Permissions:

A role carries a second, independent permission set that applies only to AI-assisted requests, so an agent acting on your behalf can be held to a narrower scope than you hold yourself. Two fields control it, and both are set on the role definition you pass to raptor apply role:

• aiMode: how AI-assisted requests are authorized for this role.
  • INHERIT: AI uses the same permissions the role already grants.
  • CUSTOM: AI uses the aiPermissions list instead, plus the Kubernetes permissions from the regular role.
• aiPermissions: the permission tokens available to AI-assisted requests when aiMode is CUSTOM. This list must be a subset of the role's permissions.

roleName: release-manager
description: "Can manage releases and view resources"
permissions:
  - RELEASE_FULL
  - RESOURCE_OVERRIDE
  - ENVIRONMENT_CONFIGURE
aiMode: CUSTOM
aiPermissions:
  - ENVIRONMENT_CONFIGURE

Apply it with raptor apply role -f role.yaml.