Permissions matrix

The complete set of Control Plane named permissions, grouped by resource family, as a lookup table.

Control Plane authorization uses a fixed set of named permissions, each a literal <verb>:<resource> string checked against the exact value (no wildcards). This page is the lookup table; for how roles and bindings use these, see Control Plane vs Compute Plane permissions.

Control Plane permissions

Resource family	Permission	Grants
Workspaces	read:workspaces	View workspaces
	write:workspaces	Create and update workspaces
	delete:workspaces	Delete workspaces
Users	read:users	View users
	write:users	Update users; block/unblock
	delete:users	Remove users
Groups	read:groups	View groups
	write:groups	Create/update groups and membership
	delete:groups	Delete groups
Service Accounts	read:service-accounts	View service accounts
	write:service-accounts	Create/update service accounts and keys
	delete:service-accounts	Delete service accounts
Roles	read:roles	View roles
	manage:roles	Create and assign custom roles
Invitations	read:invitations	View invitations
	write:invitations	Send invitations
Organization	manage:organization	Manage org-level settings (billing, SSO, auto-join)

Compute Plane authorization uses a different grammar - <resource> × <action> - rather than these named strings. See Control Plane vs Compute Plane permissions.

Built-in roles

The built-in roles bundle these permissions: Admin holds all of them; Manager holds the workspace, invitation, group, and service-account read/write permissions plus read:users/read:roles; Viewer holds the read permissions. See Roles and permissions for the capability breakdown.

See also

• Control Plane vs Compute Plane permissions
• Roles and permissions