Permissions matrix - e6data Docs

Control Plane authorization uses a fixed set of named permissions, each a literal <verb>:<resource> string checked against the exact value (no wildcards). This page is the lookup table; for how roles and bindings use these, see Control Plane vs Compute Plane permissions.

Control Plane permissions

Resource family	Permission	Grants
Workspaces	`read:workspaces`	View workspaces
	`write:workspaces`	Create and update workspaces
	`delete:workspaces`	Delete workspaces
Users	`read:users`	View users
	`write:users`	Update users; block/unblock
	`delete:users`	Remove users
Groups	`read:groups`	View groups
	`write:groups`	Create/update groups and membership
	`delete:groups`	Delete groups
Service Accounts	`read:service-accounts`	View service accounts
	`write:service-accounts`	Create/update service accounts and keys
	`delete:service-accounts`	Delete service accounts
Roles	`read:roles`	View roles
	`manage:roles`	Create and assign custom roles
Invitations	`read:invitations`	View invitations
	`write:invitations`	Send invitations
Organization	`manage:organization`	Manage org-level settings (billing, SSO, auto-join)

Compute Plane authorization uses a different grammar - <resource> × <action> - rather than these named strings. See Control Plane vs Compute Plane permissions.

Built-in roles

The built-in roles bundle these permissions: Admin holds all of them; Manager holds the workspace, invitation, group, and service-account read/write permissions plus read:users/read:roles; Viewer holds the read permissions. See Roles and permissions for the capability breakdown.

See also

Last modified on September 29, 2026