Permissions & Roles

Outcron uses a role-based access control (RBAC) system. Each organization membership is assigned to exactly one group. That group points to one role, and the role defines the user's effective permission tags.

Permission Tags

Permission tags follow a resource:action pattern. The full catalog:

Permission	Description
`alerts:read`	View alert rules, events, and delivery history
`alerts:write`	Manage alert rules, subscriptions, silences, and escalation policies
`apikeys:read`	View API keys
`apikeys:write`	Create and revoke API keys
`audit_logs:read`	View the organization audit log
`billing:read`	View billing summary, invoices, and subscription state
`billing:write`	Manage subscription and billing recovery actions
`executions:read`	View execution history and details
`executions:write`	Cancel executions and trigger manual runs
`groups:read`	View groups and membership
`groups:write`	Manage groups
`jobs:read`	View jobs and job details
`jobs:write`	Create, update, delete, and trigger jobs
`orgs:read`	View organization metadata and status
`orgs:write`	Update organization settings
`registries:read`	View registry credentials
`registries:write`	Manage registry credentials
`reports:read`	View shared reports and templates; widget preview/run also requires the widget dataset's read permission
`reports:write`	Manage personal reports
`reports:writeshared`	Manage shared (org-wide) reports
`roles:read`	View roles and their permission sets
`roles:write`	Manage roles
`schedules:read`	View schedules and preview timing
`schedules:write`	Create, update, pause, resume, and delete schedules
`users:read`	View org user list and details
`users:write`	Invite, add, update, and remove org users

Memberships, Groups, and Roles

Each user has one membership record per organization. The membership stores one group_id; users do not collect permissions from multiple groups in the same org.

Groups are the assignment layer. Moving a user to a different group changes their effective role and permission tags on the next org-scoped request.

Roles are named collections of permission tags. The built-in roles provide default access, and custom roles can grant narrower or broader permission sets.

The built-in Member group uses the built-in Member role. The built-in Admin group uses a role with the full org permission catalog.

Default member permissions (the exact set granted by the built-in Member role):

orgs:read
users:read
billing:read
apikeys:read
registries:read
registries:write
jobs:read
jobs:write
schedules:read
schedules:write
executions:read
executions:write
reports:read
reports:write
groups:read
roles:read
alerts:read
alerts:write

Notably excluded from default member permissions:

orgs:write — org settings changes
billing:write — billing mutations
users:write — user management
apikeys:write — API key management
groups:write — group management
roles:write — role management
reports:writeshared — shared report management
audit_logs:read — audit log access

Organization Admins

Organization admins are users assigned to a group whose role grants full org access, normally the built-in Admin group. Users in custom groups receive only the permissions on the group's role.

Report widgets do not expand dataset access. A user can view shared report definitions with reports:read, but previewing or running widgets also requires the underlying dataset read permission, such as executions:read, jobs:read, schedules:read, or users:read.