> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions matrix

> The complete set of Control Plane named permissions, grouped by resource family, as a lookup table.

Control Plane authorization uses a fixed set of named permissions, each a literal `<verb>:<resource>` string checked against the exact value (no wildcards). This page is the lookup table; for how roles and bindings use these, see [Control Plane vs Compute Plane permissions](/platform/identity/control-plane-vs-compute-plane).

## Control Plane permissions

| Resource family | Permission | Grants |
| - | - | - |
| Workspaces | `read:workspaces` | View workspaces |
| | `write:workspaces` | Create and update workspaces |
| | `delete:workspaces` | Delete workspaces |
| Users | `read:users` | View users |
| | `write:users` | Update users; block/unblock |
| | `delete:users` | Remove users |
| Groups | `read:groups` | View groups |
| | `write:groups` | Create/update groups and membership |
| | `delete:groups` | Delete groups |
| Service Accounts | `read:service-accounts` | View service accounts |
| | `write:service-accounts` | Create/update service accounts and keys |
| | `delete:service-accounts` | Delete service accounts |
| Roles | `read:roles` | View roles |
| | `manage:roles` | Create and assign custom roles |
| Invitations | `read:invitations` | View invitations |
| | `write:invitations` | Send invitations |
| Organization | `manage:organization` | Manage org-level settings (billing, SSO, auto-join) |

<Info>
  Compute Plane authorization uses a different grammar - `<resource>` × `<action>` - rather than these named strings. See [Control Plane vs Compute Plane permissions](/platform/identity/control-plane-vs-compute-plane).
</Info>

## Built-in roles

The built-in roles bundle these permissions: **Admin** holds all of them; **Manager** holds the workspace, invitation, group, and service-account read/write permissions plus `read:users`/`read:roles`; **Viewer** holds the read permissions. See [Roles and permissions](/platform/identity/roles-and-permissions) for the capability breakdown.

## See also

* [Control Plane vs Compute Plane permissions](/platform/identity/control-plane-vs-compute-plane)
* [Roles and permissions](/platform/identity/roles-and-permissions)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.