> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Platform RBAC role and permission catalogs across organization, tenant, and workspace scopes

Field and catalog reference for platform RBAC. Agent runtime authorization uses Cedar and is separate from this catalog.

Refer to [Permissions](/concepts/platform/permissions) concept for how platform RBAC works. Assign members and keys on [Manage Access](/manage/access).

## Workspace roles

Every workspace member has one of six roles.

| Role             | Description                      | Key capabilities                                                                                                                                                                                            |
| ---------------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **admin**        | Full workspace management        | All workspace operations including member management, configuration, and workspace deletion                                                                                                                 |
| **operator**     | Day-to-day workspace operations  | Register, suspend, revoke, and delete agents. Manage agent and API keys. Deploy and roll back rules. Manage gateway and integrations. Export audit. Cannot delete the workspace or change the admin roster. |
| **security**     | Authorization rules and audit    | Deploy and roll back rules, simulate, suspend agents, query and export audit                                                                                                                                |
| **developer**    | Agent integration work           | Register and update agents, manage agent keys, view rules, audit, gateway, and integrations (no deploy, no export)                                                                                          |
| **viewer**       | Read-only access                 | List agents, view rules, gateway, audit, and integrations                                                                                                                                                   |
| **impersonator** | Reserved for impersonation flows | No standing permissions. Used by sessions impersonating another user.                                                                                                                                       |

### Workspace-scoped permissions

✅ means the role has the permission. ❌ means it does not.

| Permission               | admin | operator | security | developer | viewer |
| ------------------------ | :---: | :------: | :------: | :-------: | :----: |
| `agent.view`             |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `agent.register`         |   ✅   |     ✅    |     ❌    |     ✅     |    ❌   |
| `agent.suspend`          |   ✅   |     ✅    |     ✅    |     ✅     |    ❌   |
| `agent.revoke`           |   ✅   |     ✅    |     ❌    |     ✅     |    ❌   |
| `agent.delete`           |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `agentkey.manage`        |   ✅   |     ✅    |     ❌    |     ✅     |    ❌   |
| `rules.view`             |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `rules.deploy`           |   ✅   |     ✅    |     ✅    |     ❌     |    ❌   |
| `rules.rollback`         |   ✅   |     ✅    |     ✅    |     ❌     |    ❌   |
| `gateway.view`           |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `gateway.manage`         |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `audit.view`             |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `audit.export`           |   ✅   |     ✅    |     ✅    |     ❌     |    ❌   |
| `workspace.manage`       |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `workspace.delete`       |   ✅   |     ❌    |     ❌    |     ❌     |    ❌   |
| `workspace.manage_admin` |   ✅   |     ❌    |     ❌    |     ❌     |    ❌   |
| `apikey.manage`          |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `config.manage`          |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `integrations.view`      |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `integrations.manage`    |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `judges.view`            |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `judges.manage`          |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `eventing.view`          |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `eventing.manage`        |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `eventing.replay`        |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |
| `filters.view`           |   ✅   |     ✅    |     ✅    |     ✅     |    ✅   |
| `filters.manage`         |   ✅   |     ✅    |     ❌    |     ❌     |    ❌   |

`judges.view` and `judges.manage` gate [Intelligent Authorization](/govern/judges). Preconfigured judges remain immutable regardless of `judges.manage`. Renamed from `moot.view` / `moot.manage` in the 2026-06 release.

`eventing.*` gates [Subscribe to Events](/operate/webhooks). `filters.*` gates Guard filter configuration. See those how-tos for operation detail.

`workspace.manage_admin` is the workspace-direct admin marker. It gates adding, removing, or changing the role of any user to or from workspace admin. It distinguishes workspace `admin` from workspace `operator`. The latter operates the workspace end-to-end but cannot reshape its admin roster. The distinction collapses at the tenant scope. Tenant `admin` and tenant `operator` cascades both grant `workspace.manage_admin` across every workspace in the tenant. Org `owner` and `admin` cascades grant it as well.

## Tenant roles

Tenant roles grant tenant-scoped permissions and cascade workspace permissions into every workspace in the tenant.

| Role             | Description                                                                                                                                                                | Workspace cascade                                                                                                |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| **admin**        | Full tenant management, including tenant deletion                                                                                                                          | Full workspace `admin` permissions in every workspace, including `workspace.delete` and `workspace.manage_admin` |
| **operator**     | Tenant operations end-to-end except tenant deletion                                                                                                                        | Identical to tenant `admin` cascade                                                                              |
| **security**     | Sandbox creation and security review across the tenant                                                                                                                     | Workspace `security` permissions in every workspace                                                              |
| **member**       | Sandbox workspace creation only                                                                                                                                            | None                                                                                                             |
| **impersonator** | Reserved for impersonation flows                                                                                                                                           | None                                                                                                             |
| **unprivileged** | Cross-domain workspace invitee in an org with at least one verified domain. No tenant-scoped permissions. Access is limited to workspaces they were explicitly invited to. | None                                                                                                             |

### Tenant-scoped permissions

✅ means the role has the permission. ❌ means it does not.

| Permission                 | admin | operator | security | member | unprivileged |
| -------------------------- | :---: | :------: | :------: | :----: | :----------: |
| `tenant.view`              |   ✅   |     ✅    |     ✅    |    ✅   |       ❌      |
| `tenant.manage`            |   ✅   |     ✅    |     ❌    |    ❌   |       ❌      |
| `tenant.delete`            |   ✅   |     ❌    |     ❌    |    ❌   |       ❌      |
| `sandbox.workspace.create` |   ✅   |     ✅    |     ✅    |    ✅   |       ❌      |
| `apikey.manage`            |   ✅   |     ✅    |     ❌    |    ❌   |       ❌      |

Tenant admin, operator, and security inherit workspace permissions across every workspace in the tenant. Tenant member receives no workspace cascade. Assign a workspace role separately to grant workspace access.

`tenant.delete` is the admin-only marker at the tenant-direct scope, analogous to `workspace.delete`. Tenant operators run the tenant end-to-end but cannot delete it. Org `owner` and `admin` cascade `tenant.delete` across every tenant.

## Organization roles

Organization roles cascade into every tenant and workspace in the org.

| Role             | Description                                                                                                                                                                                                      | Cascade                                                                                     |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| **owner**        | Full org management. Create and delete tenants. Manage org members.                                                                                                                                              | Full tenant admin and workspace admin grants across every tenant, including `tenant.delete` |
| **admin**        | Tenant management. Create workspaces. Assign workspace roles.                                                                                                                                                    | Same as owner                                                                               |
| **member**       | Org membership without standing permissions                                                                                                                                                                      | None                                                                                        |
| **unprivileged** | Cross-domain workspace invitee in an org with at least one verified domain. No org-scoped permissions and no auto-enrollment into open tenants. Access is limited to workspaces they were explicitly invited to. | None                                                                                        |

### Org-scoped permissions

✅ means the role has the permission. ❌ means it does not.

| Permission              | owner | admin | member | unprivileged |
| ----------------------- | :---: | :---: | :----: | :----------: |
| `org.view`              |   ✅   |   ✅   |    ✅   |       ❌      |
| `tenant.manage`         |   ✅   |   ✅   |    ❌   |       ❌      |
| `sandbox.tenant.create` |   ✅   |   ✅   |    ❌   |       ❌      |
| `apikey.manage`         |   ✅   |   ✅   |    ❌   |       ❌      |

`org.view` gates "I'm a real participant in this org" reads. The `ListJoinableTenants` endpoint requires it, so unprivileged invitees cannot enumerate the org's open tenants.

## Grantable permission discovery

Platform API keys take an explicit permission list. Discover what the caller may grant with:

* CLI: [`dome platform-keys permissions`](/cli/settings/platform-keys)
* MCP: [`dome_platform_keys_available_permissions`](/reference/mcp/platform)
* API: [`GetGrantablePermissions`](/api/management/get-grantable-permissions), [`ResolvePermissions`](/api/management/resolve-permissions)

## Next steps

Grant these from Manage Access. Agent runtime auth is Cedar:

* [Permissions](/concepts/platform/permissions) concept for how platform RBAC relates to agent authorization
* [Manage Access](/manage/access) to assign members and create platform keys
* [Scopes](/concepts/platform/scopes) concept for the org → tenant → workspace hierarchy
* [Authorization Model](/concepts/architecture/authorization-model) concept for Cedar agent authorization
* [Rules](/reference/controls/rules) reference for the entity, action, and attribute catalogs