Permissions reference

A single table of every action that access policies can allow or deny, grouped by feature, so you do not have to hunt through the individual pages.

Requires a Console release with the IAM engine

The actions below are the ones of the policy engine described in Authorization (IAM). The same catalog is served by the Console at GET /api/iam/catalog and shown in the policy editor, so a service or resource type added in a later release appears there first.

Every action has one of three levels: Read, Write or Admin. Levels add up: Admin includes Write and Read, Write includes Read. A policy that allows an action also covers the lower levels of the same service, while a policy that denies an action blocks exactly what it names.

There are three kinds of action:

1. Level groups: Read, Write, Admin. The built-in policies are written against these.
2. Service actions: <service>.read, <service>.write, <service>.admin, one set for each service in the first table. The request gate asks for <service>.read on GET, HEAD and OPTIONS, and <service>.write on every other method.
3. Resource actions: <type>.<verb> for one kind of resource, for example agent.invoke or model.infer. The second and third tables list them.

Service actions

Each service has the actions <service>.read, <service>.write and <service>.admin. They are enforced in the dashboard and api channels, that is, for every request to the Console UI and to the client API.

In the Admin-only changes column, Yes means the service is administrative: reading needs read, but every change needs admin, so by default only owners and administrators can change it.

Service id	Name	Category	Admin-only changes	Actions	Covers
models	Model Hub	build	No	models.read, models.write, models.admin	Models, providers and inference setup.
prompts	Prompt Studio	build	No	prompts.read, prompts.write, prompts.admin	Prompt templates and versions.
agents	Agents	build	No	agents.read, agents.write, agents.admin	AI agents and agent versions.
mcp	MCP Hub	build	No	mcp.read, mcp.write, mcp.admin	MCP server configuration, proxy APIs, monitoring and audit.
tools	Agent Tools	build	No	tools.read, tools.write, tools.admin	Tool definitions used by agents.
vector	Knowledge Index	data	No	vector.read, vector.write, vector.admin	Vector providers, indexes and vector operations.
memory	Agent Memory	data	No	memory.read, memory.write, memory.admin	Memory stores and memory items.
files	Document Store	data	No	files.read, files.write, files.admin	File buckets and file objects.
rag	Knowledge Engine	data	No	rag.read, rag.write, rag.admin	Knowledge Engine modules, documents and chunks.
reranker	Reranker	data	No	reranker.read, reranker.write, reranker.admin	Reranker services and run logs.
realtime	Realtime	build	No	realtime.read, realtime.write, realtime.admin	Realtime models, live sessions and telephony bridges.
tracing	Agent Observability	operate	No	tracing.read, tracing.write, tracing.admin	Tracing sessions, threads and events.
inference-monitoring	Model Monitoring	operate	No	inference-monitoring.read, inference-monitoring.write, inference-monitoring.admin	Inference servers and metrics.
guardrails	Guardrail	operate	No	guardrails.read, guardrails.write, guardrails.admin	Guardrail policies, hook bindings, tool-execution policy and evaluation logs.
evaluations	Evaluations	operate	No	evaluations.read, evaluations.write, evaluations.admin	Targets, datasets, suites and runs.
redteam	Red Team	operate	No	redteam.read, redteam.write, redteam.admin	Probes, campaigns and vulnerability scans.
analysis	Conversation Analysis	operate	No	analysis.read, analysis.write, analysis.admin	Field extraction, quality judging and accuracy scoring.
pii	PII Service	operate	No	pii.read, pii.write, pii.admin	PII detection, redaction and masking policies.
browser	Browsers	operate	No	browser.read, browser.write, browser.admin	Managed browser profiles and sessions.
crawler	Crawler	data	No	crawler.read, crawler.write, crawler.admin	Web crawlers that ingest markdown into knowledge engines.
websearch	Web Search	data	No	websearch.read, websearch.write, websearch.admin	Web search providers and search APIs.
ocr	OCR Jobs	data	No	ocr.read, ocr.write, ocr.admin	Batch OCR and extraction jobs.
alerts	Alerts & Incidents	operate	No	alerts.read, alerts.write, alerts.admin	Alert rules, history and incidents.
cost	Cost Management	operate	No	cost.read, cost.write, cost.admin	Spend attribution and reference pricing.
abacus	Abacus	operate	No	abacus.read, abacus.write, abacus.admin	Cost intelligence: what-if repricing, recommendations, parity testing.
ai-app-gateway	AI App Gateway	operate	No	ai-app-gateway.read, ai-app-gateway.write, ai-app-gateway.admin	Coding-agent gateway instances and session traces.
projects	Projects	admin	No	projects.read, projects.write, projects.admin	Project contexts and project-scoped access.
tokens	API Tokens	admin	No	tokens.read, tokens.write, tokens.admin	User and project API tokens.
automations	Automations	admin	Yes	automations.read, automations.write, automations.admin	Schedulers, maintenance jobs and runtime controls.
members	Members	admin	Yes	members.read, members.write, members.admin	Tenant users, invitations and roles.
providers	Providers	admin	Yes	providers.read, providers.write, providers.admin	Tenant-level provider credentials and integrations.
config	Config Management	admin	Yes	config.read, config.write, config.admin	Tenant configuration and secrets.
license	License	admin	Yes	license.read, license.write, license.admin	Offline license activation and limits.
audit	Audit Log	admin	Yes	audit.read, audit.write, audit.admin	Security and administrative audit events.
gpu-fleet	GPU Fleet	operate	Yes	gpu-fleet.read, gpu-fleet.write, gpu-fleet.admin	GPU hosts, MIG slices, deployments, terminal access.
sandbox	Sandbox	operate	Yes	sandbox.read, sandbox.write, sandbox.admin	Runners, templates, instances, volumes, terminal access.
cluster	Cluster	admin	Yes	cluster.read, cluster.write, cluster.admin	Node registry and per-instance orchestration.
sso	Single Sign-On	admin	Yes	sso.read, sso.write, sso.admin	OIDC connection, attribute mapping, JIT provisioning.
webhooks	Webhooks	admin	Yes	webhooks.read, webhooks.write, webhooks.admin	Outgoing webhook subscriptions.
ldap	LDAP Directory	admin	Yes	ldap.read, ldap.write, ldap.admin	LDAP/AD connection, group-to-role mapping, JIT provisioning.
portals	Portals	admin	Yes	portals.read, portals.write, portals.admin	Chat portals, access lists and usage statistics.
resources	Resource Registry	admin	Yes	resources.read, resources.write, resources.admin	Read-only tenant-wide inventory across all projects.
iam	Authorization Engine	admin	Yes	iam.read, iam.write, iam.admin	Custom policies, access check, denial history, token rules.

The legacy aegis service

aegis is a retired alias of guardrails. It is kept so older grants keep resolving; grant guardrails instead.

Resource actions

Every resource type in the registry gets five actions. get and list are Read, create, update and delete are Write. They are evaluated by the Access check and the policy preview; the request gates themselves ask for the service action of the owning service. Use them in a custom policy to narrow one named resource, for example to deny model.update on a single production model.

Resource type	Name	Service	Feature page
mcp-server	MCP server	mcp	page
skill	Agent skill	agents	page
prompt	Prompt	prompts	page
memory-store	Memory store	memory	page
browser	Browser profile	browser	page
browser-flow	Browser flow	browser	page
agent	Agent	agents	page
tool	Tool	tools	page
model	Model	models	page
evaluation-target	Evaluation target	evaluations	page
evaluation-dataset	Evaluation dataset	evaluations	page
evaluation-suite	Evaluation suite	evaluations	page
redteam-campaign	Red-team campaign	redteam	page
redteam-custom-probe	Red-team custom probe	redteam	page
analysis-definition	Analysis definition	analysis	page
provider	Provider	providers	page
inference-server	Inference server	inference-monitoring	page
guardrail	Guardrail	guardrails	page
guardrail-word-list	Guardrail word list	guardrails	page
pii-policy	PII policy	pii	page
rag-module	Knowledge Engine module	rag	page
vector-index	Vector index	vector	page
file-bucket	File bucket	files	page
crawler	Crawler	crawler	page
reranker	Reranker	reranker	page
alert-rule	Alert rule	alerts	page
config-group	Config group	config	page
quota-policy	Quota policy	projects	page
portal	Portal (Enterprise)	portals	page

Each type has <type>.get, <type>.list (Read) and <type>.create, <type>.update, <type>.delete (Write). The registry is open-ended: the list above is what this build registers, and the IAM center shows the live list.

Execution and session actions

These actions go beyond create/read/update/delete. The Enforced in column says which channels a real request is held to the answer in. An empty cell means the Access check and the preview evaluate it, but no request of the product asks for it yet.

Action	Level	What it decides	Enforced in	Who can do this
agent.invoke	Write	Sending a message to an agent through a portal	portal	Portal access
portal.use	Read	Opening a portal, on every request made to it	portal	Portal access
portal.conversations_view	Admin	Reading what people said in a portal (the Conversations tab). Not part of the portal's Read or Write group, so only owners and administrators hold it until a policy grants it	dashboard, api	Portal administration
agent.approve	Write	Answering somebody's pending tool approval or question	dashboard, api, portal	Approvals
agent.session_view_others	Read	Looking at a session somebody else started	dashboard, api	Sessions
agent.session_manage_others	Write	Acting on a session somebody else started	dashboard, api	Sessions
file-bucket.get	Read	Listing a bucket as a choice for an agent's session files	dashboard, api	Files
file-bucket.update	Write	Naming a bucket in an agent's Files settings	dashboard, api	Files
tool.execute	Write	Running a tool		Tools
mcp-server.call	Write	Calling an MCP server		MCP servers
rag-module.query	Write	Querying a Knowledge Engine module		Knowledge Engine
model.infer	Write	Running inference on a model		Model Hub

agent.session_view_others and agent.session_manage_others sit in the Read and Write groups, so by default every reader or writer of the agents service holds them. A deny rule narrows them. agent.invoke, portal.use and the portal channel exist only where the Enterprise portal module is installed; a policy rule about them is accepted, and said to take effect, only there. Webhook permissions are service-level: see Webhook permissions.

Channels

An action is decided in one of these channels: dashboard (the Console UI), api (the client API) or portal (the end-user runtime of a portal). A policy can match on the channel, so the same person can be allowed in the dashboard and refused through the API.