Reference

Permission glossary

The 45 permission keys in inlorus: their resource, meaning, risk and which role archetypes carry them.

For: Platform administrator, Builder, Account administrator, Tenant administrator, Operator, Auditor, Member

The shape of a key

Every permission is a key in the form resource.verb, and no scope name appears in the key; the assignment decides the scope. Today there are 18 resources, 4 verbs and 45 keys. Each resource takes only the verbs that fit it: publish applies only to things others use, purge only to things that hold data.

Verb	Meaning	Risk
`read`	see	low
`write`	create and change	medium
`publish`	make available for others to use	high
`purge`	delete irreversibly	critical

Tip purge is granted only in the scope that owns the data and never flows down from above. The other verbs flow down from the scope above to the scopes below.

Resources

Resource	What	Verbs it takes
`application`	Applications, runtimes and actions	`read`, `write`, `publish`
`audit`	The audit trail (the system writes it; no role does)	`read`
`capability`	Capabilities and their versions	`read`, `write`, `publish`
`config`	Configuration values	`read`, `write`
`domain`	Domains	`read`, `write`
`integration`	Connections to external systems	`read`, `write`
`journey`	Onboarding journeys	`read`, `write`, `publish`
`listing`	Marketplace listings	`read`, `write`, `publish`
`membership`	Memberships and invites	`read`, `write`
`metadata`	Data schema: entity, field, relation	`read`, `write`, `publish`
`operations`	Health, service objectives and incidents	`read`, `write`
`policy`	Policies and floors	`read`, `write`, `publish`
`record`	Records	`read`, `write`, `purge`
`role`	Roles and role assignments	`read`, `write`
`scope`	Scopes: the lifecycle of accounts and tenants, opening capabilities	`read`, `write`, `purge`
`solution`	Solutions	`read`, `write`, `publish`
`team`	A tenant's teams	`read`, `write`
`workspace`	Workspaces	`read`, `write`, `purge`

All keys

The last column shows the role archetypes that carry the key in their package. Administrator carries every key in the scope it is assigned in.

Key	Resource	Meaning	Risk	Archetypes carrying it
`application.publish`	Applications, runtimes and actions	make available for others to use	high	Administrator, Builder
`application.read`	Applications, runtimes and actions	see	low	Administrator, Builder, Operator, Auditor
`application.write`	Applications, runtimes and actions	create and change	medium	Administrator, Builder
`audit.read`	The audit trail (the system writes it; no role does)	see	low	Administrator, Auditor
`capability.publish`	Capabilities and their versions	make available for others to use	high	Administrator, Builder
`capability.read`	Capabilities and their versions	see	low	Administrator, Builder, Operator, Auditor
`capability.write`	Capabilities and their versions	create and change	medium	Administrator, Builder
`config.read`	Configuration values	see	low	Administrator, Operator, Member, Auditor
`config.write`	Configuration values	create and change	medium	Administrator
`domain.read`	Domains	see	low	Administrator, Auditor
`domain.write`	Domains	create and change	medium	Administrator
`integration.read`	Connections to external systems	see	low	Administrator, Operator, Auditor
`integration.write`	Connections to external systems	create and change	medium	Administrator, Operator
`journey.publish`	Onboarding journeys	make available for others to use	high	Administrator
`journey.read`	Onboarding journeys	see	low	Administrator, Auditor
`journey.write`	Onboarding journeys	create and change	medium	Administrator
`listing.publish`	Marketplace listings	make available for others to use	high	Administrator
`listing.read`	Marketplace listings	see	low	Administrator, Auditor
`listing.write`	Marketplace listings	create and change	medium	Administrator
`membership.read`	Memberships and invites	see	low	Administrator, Auditor
`membership.write`	Memberships and invites	create and change	medium	Administrator
`metadata.publish`	Data schema: entity, field, relation	make available for others to use	high	Administrator, Builder
`metadata.read`	Data schema: entity, field, relation	see	low	Administrator, Builder, Auditor
`metadata.write`	Data schema: entity, field, relation	create and change	medium	Administrator, Builder
`operations.read`	Health, service objectives and incidents	see	low	Administrator, Operator, Auditor
`operations.write`	Health, service objectives and incidents	create and change	medium	Administrator, Operator
`policy.publish`	Policies and floors	make available for others to use	high	Administrator
`policy.read`	Policies and floors	see	low	Administrator, Auditor
`policy.write`	Policies and floors	create and change	medium	Administrator
`record.purge`	Records	delete irreversibly	critical	Administrator
`record.read`	Records	see	low	Administrator, Member, Auditor
`record.write`	Records	create and change	medium	Administrator, Member
`role.read`	Roles and role assignments	see	low	Administrator, Auditor
`role.write`	Roles and role assignments	create and change	medium	Administrator
`scope.purge`	Scopes: the lifecycle of accounts and tenants, opening capabilities	delete irreversibly	critical	Administrator
`scope.read`	Scopes: the lifecycle of accounts and tenants, opening capabilities	see	low	Administrator, Auditor
`scope.write`	Scopes: the lifecycle of accounts and tenants, opening capabilities	create and change	medium	Administrator
`solution.publish`	Solutions	make available for others to use	high	Administrator, Builder
`solution.read`	Solutions	see	low	Administrator, Builder, Auditor
`solution.write`	Solutions	create and change	medium	Administrator, Builder
`team.read`	A tenant's teams	see	low	Administrator, Auditor
`team.write`	A tenant's teams	create and change	medium	Administrator
`workspace.purge`	Workspaces	delete irreversibly	critical	Administrator
`workspace.read`	Workspaces	see	low	Administrator, Builder, Operator, Member, Auditor
`workspace.write`	Workspaces	create and change	medium	Administrator, Builder