User Management & Permissions

RBAC roles defined in Facets have a list of associated permissions that grant the user privileges to perform certain actions. This page provides a comprehensive overview of the permissions available within the system. You can find a comprehensive list of permissions listed below.

Common Permissions:

1. Write: Grants permission to create and edit entities.
2. Delete: Grants permission to delete entities.

List of Permissions:

The table below categorizes permissions by their respective areas, detailing the capabilities granted under each category.

• Category: Represents the functional area or entity within the system.
• Write: Indicates whether write permission is available within the category.
• Delete: Indicates whether delete permission is available within the category.
• Special Permissions: Lists any additional specific permissions that provide more granular control over actions within the category.
• Permission Tokens: The raw identifiers the API, the CLI, and custom role definitions use. Pass one to raptor auth can-i PERMISSION to check whether you hold it, and list them under permissions when you define a custom role with raptor apply role.

Permissions are added as the platform grows, so treat this table as a reference rather than the definitive registry. Run raptor auth can-i with no argument for an overview of the permissions your own account currently holds.

AI Permissions:

A role carries a second, independent permission set that applies only to AI-assisted requests, so an agent acting on your behalf can be held to a narrower scope than you hold yourself. Two fields control it, and both are set on the role definition you pass to raptor apply role:

• aiMode: how AI-assisted requests are authorized for this role.
  • INHERIT: AI uses the same permissions the role already grants.
  • CUSTOM: AI uses the aiPermissions list instead, plus the Kubernetes permissions from the regular role.
• aiPermissions: the permission tokens available to AI-assisted requests when aiMode is CUSTOM. This list must be a subset of the role's permissions.

roleName: release-manager
description: "Can manage releases and view resources"
permissions:
  - RELEASE_FULL
  - RESOURCE_OVERRIDE
  - ENVIRONMENT_CONFIGURE
aiMode: CUSTOM
aiPermissions:
  - ENVIRONMENT_CONFIGURE

Apply it with raptor apply role -f role.yaml.