Skip to content
SanShivaSHELL ELOS Docs
Browse the documentation
Documentation home
Get started
Administer
Automate
Join and grow
Operate
Transfer
Preserve and Ask ELOS
Reference

Roles, permissions and read scope

For administrators, security and compliance 6 min readAvailability depends on your plan

Use the built-in roles, tailor them, or compose custom roles from the permission catalog, and limit what a role can see.

Before you begin

  • The Manage roles permission, which only administrators hold.

Every action in ELOS is checked against a permission. A role is a set of permissions; each member has one role. The server enforces least privilege: you can only grant permissions you hold.

Built-in roles

RoleFor
Platform AdminEverything, including roles and settings. Fixed, so there is always a break-glass administrator.
Engineering ManagerTeam operations: people, approvals, access reviews, the service catalog and compliance views.
EngineerReading, authoring docs, requesting access and using Ask ELOS. No approvals or administration.
AuditorRead-only compliance: the audit log, access reviews and evidence.

Choose Customize on a built-in role to change its permissions for your workspace. Platform Admin can't be changed.

The Roles & permissions page with one custom role and the four built-in roles
Roles & permissions: custom roles first, then the built-in roles and their permissions.

Create a custom role

  1. Open Roles & permissions and choose New role.
  2. Enter a Name and a Description that says what the role is for.
  3. Select its Permissions. Sensitive permissions, such as Approve access or Manage people, are marked.
  4. Optionally, under Applies to, choose Specific services to restrict editing to the services you pick.
  5. Under What this role can see, keep Whole organization or choose Limited by team, tier, or service.
  6. Choose Create role. Then assign it on the Members page.
The New custom role panel with name, description and the permission catalog
New custom role: compose a role from the permission catalog.

Read scope

Read scope limits what a role can see to the services owned by chosen Owning teams, of chosen Service tiers, or picked individually. On the role list, a limited role shows what it sees, for example sees Payments.

The same scope applies to Ask ELOS: an answer only uses what the person asking can see in the product.

See the permissions reference for every permission.

What's next