> For the complete documentation index, see [llms.txt](https://docs.rewst.help/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rewst.help/rewst-documentation/documentation/settings/permissions-matrix.md).

# Permissions matrix

{% hint style="info" %}
These permissions are used when assigning roles in Rewst. For more on how to use them and assign roles, see our documentation for Rewst settings [here](/rewst-documentation/documentation/settings.md#roles). 
{% endhint %}

### Achievement permissions <a href="#user-content-achievements" id="user-content-achievements"></a>

| Permission               | What it does                                                                                                                                                            |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `achievement:read`       | Add read access in this organization. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions. |
| `achievement:manage_own` | Create and manage this tenant's own achievement definitions. Review the resource and verb to confirm how broadly you want the role to act.                              |
| `achievement:grant_own`  | Grant this tenant's own achievements, requiring `manage_own` alongside it. Review the resource and verb to confirm how broadly you want the role to act.                |

### Agent permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>agent:read</code></td><td>View agents and agent tools in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>agent:write</code></td><td>Create, edit, or manage agents and agent tools in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>agent:execute</code></td><td>Use execute-style actions tied to agents and agent tools in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### Agent workspace permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>agent_workspace:read</code></td><td>Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>agent_workspace:write</code></td><td>Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr></tbody></table>

### App permissions <a href="#user-content-forms-and-apps" id="user-content-forms-and-apps"></a>

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>app:read</code></td><td>View apps in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>app:write</code></td><td>Create, edit, or manage apps in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>app:execute</code></td><td>Use execute-style actions tied to apps in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr><tr><td><code>app:share</code></td><td>Share apps beyond their current owner scope. Add sharing access for this area. People can make these resources available beyond their current direct owner scope where sharing is supported.</td></tr></tbody></table>

### Audit logs permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>audit_log:read</code></td><td>Inspect who changed what and when, read-only. Add read access to audit events so people can inspect who changed what and when. Audit history stays read-only.</td></tr></tbody></table>

### Auth methods permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>auth_method:read</code></td><td>View auth methods in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>auth_method:write</code></td><td>Create and manage auth methods, which can change which login methods are available. Add change access for sign-in methods. This can affect which login methods are available to people in the organization.</td></tr></tbody></table>

### Billing permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>billing:read</code></td><td>View billing settings in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>billing:write</code></td><td>Change billing settings, which can affect spend and invoicing details. Add access to billing changes that can affect spend, invoicing details, or other billing-managed settings.</td></tr></tbody></table>

### Connector permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>connector:read</code></td><td>View connectors in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr></tbody></table>

### Credential permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>credential:read</code></td><td>View credentials in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>credential:write</code></td><td>Create, edit, or manage credentials in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>credential:execute</code></td><td>Use execute-style actions tied to credentials in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### Custom integrations permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>custom_integration:read</code></td><td>View custom integrations in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>custom_integration:write</code></td><td>Create, edit, or manage custom integrations in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr></tbody></table>

### Datastore permissions

| Permission        | What it does                                                                                                                                                                                                  |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `datastore:read`  | View datastore records in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions. |
| `datastore:write` | Create, edit, or manage datastore records in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.                                     |

### Fabric permissions

Direct connector execution still requires the relevant integration permission.

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>fabric:read</code></td><td>View Fabric discovery, dashboard, profiles, policies, and access activity. Add read access to Fabric discovery, dashboard, profiles, policies, and access requests. Direct connector execution still requires the relevant integration permission.</td></tr><tr><td><code>fabric:write</code></td><td>Manage Fabric profiles, policies, and access requests, including approving or denying them. Add change access for Fabric governance, including profile and policy changes plus access request approval or denial. Direct connector execution still requires the relevant integration permission.</td></tr></tbody></table>

### Form permissions <a href="#user-content-forms-and-apps" id="user-content-forms-and-apps"></a>

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>form:read</code></td><td>View forms in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>form:write</code></td><td>Create, edit, or manage forms in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>form:execute</code></td><td>Use execute-style actions tied to forms in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### GDAP permissions

| Permission     | What it does                                                                                                                                                                                                                  |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `gdap:read`    | View GDAP connections in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.                              |
| `gdap:write`   | Create, edit, or manage GDAP connections in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.                                                      |
| `gdap:execute` | Use execute-style actions tied to GDAP connections in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration. |

### Integration permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>integration:read</code></td><td>View integrations in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>integration:write</code></td><td>Create, edit, or manage integrations in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>integration:execute</code></td><td>Use execute-style actions tied to integrations in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### Marketplace permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>marketplace:read</code></td><td>View marketplace content in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>marketplace:write</code></td><td>Create, edit, or manage marketplace content in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>marketplace:execute</code></td><td>Use execute-style actions tied to marketplace content in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### MCP tokens permissions&#x20;

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>mcp_token:read</code></td><td>View MCP tokens in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>mcp_token:write</code></td><td>Add token-management access. Issue, update, and revoke MCP tokens, which are tied to the role's effective access. People can issue MCP tokens tied to the role's effective access and manage those tokens until they are revoked or expire.</td></tr></tbody></table>

### Membership permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>membership:read</code></td><td>View memberships in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>membership:write</code></td><td>Manage the records controlling how people are attached to this organization. Add access to membership records that control how people are attached to this organization.</td></tr></tbody></table>

### Microsoft credentials permissions

| Permission                     | What it does                                                                                                                                                                                                                       |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `microsoft_credential:read`    | View Microsoft credentials in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.                  |
| `microsoft_credential:write`   | Create, edit, or manage Microsoft credentials in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.                                                      |
| `microsoft_credential:execute` | Use execute-style actions tied to Microsoft credentials in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration. |

### Org variables permissions

| Permission           | What it does                                                                                                                                                                                                       |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `org_variable:read`  | View organization variables in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions. |
| `org_variable:write` | Create, edit, or manage organization variables in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.                                     |

### Platform identity permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>platform_identity:read</code></td><td>View platform identity in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>platform_identity:execute</code></td><td>Use execute-style actions tied to platform identity in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr><tr><td><code>platform_identity:operator</code></td><td>Operate platform identities, a step below full administration. Add access for this specific permission key. Review the resource and verb to confirm how broadly you want the role to act.</td></tr><tr><td><code>platform_identity:admin</code></td><td>Perform admin-level actions for platform identity in this organization. Add elevated administration access for this area inside the current organization.</td></tr></tbody></table>

### Role permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>role:read</code></td><td>View roles in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>role:write</code></td><td>Create, update, and delete custom roles, while built-in system roles stay immutable. Add role-management access for permission bundles. Built-in system roles still remain immutable.</td></tr></tbody></table>

### Run permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>run:read</code></td><td>View runs in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>run:write</code></td><td>Create, edit, or manage runs in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr></tbody></table>

### Schedule permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>schedule:read</code></td><td>View schedules in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>schedule:write</code></td><td>Create, edit, or manage schedules in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>schedule:execute</code></td><td>Use execute-style actions tied to schedules in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### SSO permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>sso_config:read</code></td><td>View SSO settings in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>sso_config:write</code></td><td>Save SSO settings, which can change how people sign in or how identities map in. Add access to save SSO settings. This can affect how people sign in or how external identities map into the organization.</td></tr><tr><td><code>sso_config:execute</code></td><td>Run SSO setup, activation, or validation flows against the current configuration. Add SSO runtime actions beyond basic viewing or editing, such as setup, activation, or validation flows tied to the current configuration.</td></tr></tbody></table>

### Support desk request permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>support_desk_request:can_create</code></td><td>Allow people with this permission to escalate a support request to Rewst when this organization's plan includes support ticketing.</td></tr></tbody></table>

### Tag permissions

| Permission  | What it does                                                                                                                                                                                     |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `tag:read`  | View tags in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions. |
| `tag:write` | Create, edit, or manage tags in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.                                     |

### Team permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>team:read</code></td><td>View team in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>team:write</code></td><td>Create, edit, or manage team in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr></tbody></table>

### Tenant permissions&#x20;

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>tenant:read</code></td><td>View organization settings in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>tenant:write</code></td><td>Create, edit, or manage organization settings in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>tenant:admin</code></td><td>Perform admin-level actions for this organization only, without Owner cascade into descendants. Add organization-admin access for this organization only. It does not make the role an Owner, and it does not cascade Owner access into descendants.</td></tr><tr><td><code>tenant:preview_as_customer</code></td><td>Preview apps as a selected customer organization without changing your signed-in tenant. Allow apps preview-as-customer sessions for this organization. This lets builders inspect runtime and PDF surfaces as the selected customer without changing their normal signed-in tenant.</td></tr></tbody></table>

### Trigger permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>trigger:read</code></td><td>View triggers in this organization</td></tr><tr><td><code>schedule:read</code></td><td>View schedules in this organization</td></tr><tr><td><code>schedule:write</code></td><td>Create, edit, or manage schedules in this organization</td></tr><tr><td><code>schedule:execute</code></td><td>Use execute-style actions tied to schedules in this organization</td></tr></tbody></table>

### Usage permissions

| Permission   | What it does                                                                                                                                                                                                                                         |
| ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `usage:read` | View usage trends, limits, and consumption activity without changing configuration. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions. |

### User permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>user:read</code></td><td>View users in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>user:write</code></td><td>Create accounts and update user state, with Owner-only restrictions still applying. Add user-management access such as creating accounts and updating user state. Owner-only restrictions still apply where the platform enforces them.</td></tr><tr><td><code>user:execute</code></td><td>Use execute-style actions tied to users in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr></tbody></table>

### Webhook permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>webhook:read</code></td><td>View webhooks in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>webhook:write</code></td><td>Create, edit, or manage webhooks in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr></tbody></table>

### Workflow permissions

<table data-search="false"><thead><tr><th>Permission</th><th>What it does</th></tr></thead><tbody><tr><td><code>workflow:read</code></td><td>View workflows in this organization. Add read access for this area. People can inspect records and related settings, but they still need write or execute permissions for changes or runtime actions.</td></tr><tr><td><code>workflow:write</code></td><td>Create, edit, or manage workflows in this organization. Add change access for this area. People can save configuration or record updates tied to this permission.</td></tr><tr><td><code>workflow:execute</code></td><td>Use execute-style actions tied to workflows in this organization. Add runtime access for this area. People can trigger actions, launches, or other execute flows tied to this permission, not just view configuration.</td></tr><tr><td><code>workflow:share</code></td><td>Share workflows beyond their current owner scope. Add sharing access for this area. People can make these resources available beyond their current direct owner scope where sharing is supported.</td></tr><tr><td><code>workflow:publish</code></td><td>Publish workflow versions, making them live, including rollback and trigger sync. Add access to make a workflow version live, including rollback and trigger synchronization actions that can change live behavior.</td></tr><tr><td><code>workflow:publish_as_node</code></td><td>Add access to expose or remove workflows as reusable workflow nodes. It does not grant access to publish workflow versions.</td></tr><tr><td><code>workflow:test</code></td><td>Run unpublished workflow versions in demo or preview mode. Add mocked test access for draft workflow versions. It does not allow live runs of unpublished versions.</td></tr><tr><td><code>workflow:test_live</code></td><td>Run unpublished workflow versions in live mode, which can fire real actions from a draft. Add high-impact test access that can execute live actions from a draft workflow version before it is published.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.rewst.help/rewst-documentation/documentation/settings/permissions-matrix.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.