> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/reference/platform-reference/permissions-matrix.md).

# Permissions matrix

The complete set of Control Plane named permissions, grouped by resource family, as a lookup table.

Control Plane authorization uses a fixed set of named permissions, each a literal `<verb>:<resource>` string checked against the exact value (no wildcards). This page is the lookup table; for how roles and bindings use these, see [Control Plane vs Compute Plane permissions](/query-engine/guides/security/identity-and-rbac/control-plane-vs-compute-plane-permissions.md).

## Control Plane permissions

| Resource family  | Permission                | Grants                                              |
| ---------------- | ------------------------- | --------------------------------------------------- |
| Workspaces       | `read:workspaces`         | View workspaces                                     |
|                  | `write:workspaces`        | Create and update workspaces                        |
|                  | `delete:workspaces`       | Delete workspaces                                   |
| Users            | `read:users`              | View users                                          |
|                  | `write:users`             | Update users; block/unblock                         |
|                  | `delete:users`            | Remove users                                        |
| Groups           | `read:groups`             | View groups                                         |
|                  | `write:groups`            | Create/update groups and membership                 |
|                  | `delete:groups`           | Delete groups                                       |
| Service Accounts | `read:service-accounts`   | View service accounts                               |
|                  | `write:service-accounts`  | Create/update service accounts and keys             |
|                  | `delete:service-accounts` | Delete service accounts                             |
| Roles            | `read:roles`              | View roles                                          |
|                  | `manage:roles`            | Create and assign custom roles                      |
| Invitations      | `read:invitations`        | View invitations                                    |
|                  | `write:invitations`       | Send invitations                                    |
| Organization     | `manage:organization`     | Manage org-level settings (billing, SSO, auto-join) |

{% hint style="info" %}
Compute Plane authorization uses a different grammar - `<resource>` × `<action>` - rather than these named strings. See [Control Plane vs Compute Plane permissions](/query-engine/guides/security/identity-and-rbac/control-plane-vs-compute-plane-permissions.md).
{% endhint %}

## Built-in roles

The built-in roles bundle these permissions: **Admin** holds all of them; **Manager** holds the workspace, invitation, group, and service-account read/write permissions plus `read:users`/`read:roles`; **Viewer** holds the read permissions. See [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md) for the capability breakdown.

## See also

* [Control Plane vs Compute Plane permissions](/query-engine/guides/security/identity-and-rbac/control-plane-vs-compute-plane-permissions.md)
* [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/reference/platform-reference/permissions-matrix.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.