Permissions reference
For administrators, security and compliance 4 min read
Every permission in ELOS, what it allows, and which ones are sensitive.
Roles are built from these permissions. The server checks them on every request; the portal only shows what your role allows. Sensitive permissions are flagged in the role editor.
| Permission | Key | Allows | Sensitive |
|---|---|---|---|
| Read tenant data | read | View services, people, knowledge and onboarding | No |
| View audit & compliance | audit.view | The audit log, access reviews and compliance evidence | No |
| Author docs | docs.write | Create, lint and publish docs | No |
| Request access | access.request | Raise access requests for approval | No |
| Edit service catalog | service.edit | Update service metadata and assign owners | No |
| Run access reviews | reviews.manage | Start reviews and decide access | No |
| Approve access | access.approve | Approve or deny access requests, which issues grants | Yes |
| Manage people | people.manage | Register joiners, start onboarding, change roles and offboard | Yes |
| Manage integrations | integrations.manage | Connect and disconnect tools, and sync them | Yes |
| Manage settings | settings.manage | Edit workspace settings: retention, policy and compliance scope | Yes |
| Manage roles | roles.manage | Create and edit roles and service accounts. Reserved to administrators; can't be placed in a custom role. | Yes |
| Use Ask ELOS | ai.use | Ask the assistant for grounded, cited answers | No |
| Use AI agents | ai.agents | Answers that use several AI agents; agents only reach data the role can already see | No |
| Let AI draft actions | ai.actions | Let the assistant propose actions, such as an access request. Proposals go to approval and still need the action's own permission. | Yes |
Rules
- You can only grant permissions you hold, in a role or by assigning a role to someone.
- Platform Admin is fixed, so there's always a break-glass administrator.
- A custom role's read scope limits what it sees everywhere, including in Ask ELOS.
What's next
- Lifecycle model and glossary: The five pillars, the seven steps of an engineer's journey inside them, and the terms used across ELOS.