Default Permissions

List of default permissions granted to the Organizations, Teams and Users roles.

Customizable Permissions

Only a Provider Admin can create or change keychains and roles. On hosted Layer5 Cloud, Layer5 operates the Provider Admin role, so an organization cannot build a custom permission set itself. On a self-hosted deployment, the operator’s Provider Admins can. Changing the keychains of a role changes that role for every organization that uses it.

Legend:

✅* user must be resource owner in order to perform action.
✅ user is allowed to perform action regardless of resource ownership.

Catalog Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Share Design	Share design with anyone within your organization, and make your design easily accessible to all relevant team members.	✅	✅	❌	❌	✅	❌	✅	✅
Clone Design	Clone any published design to customise it according to your use cases	✅	✅	❌	❌	✅	❌	✅	✅
View Catalog	View all items in catalog	✅	✅	❌	❌	✅	❌	✅	✅

Designs Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Designs	View all public and published designs of other team members and private of signed-in user	✅	✅	❌	❌	✅	❌	✅	✅
Create new design	Create new Meshery design	✅	✅	❌	❌	✅	❌	✅	✅
Import Design	Import a design	✅	✅	❌	❌	✅	❌	✅	✅
Publish Design	Publish a design	✅	✅	❌	❌	✅	❌	✅	✅
Unpublish Design	Unpublish a design	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Validate Design	Validate a design	✅	✅	❌	❌	✅	❌	✅	✅
Deploy Design	Deploy a design	❌	❌	❌	❌	✅	❌	✅	✅
Undeploy Design	Retract all resources used in a Meshery design from the cluster	❌	❌	❌	❌	✅	❌	✅	✅
Details of design	Set design information or details of a design	✅	✅	❌	❌	✅	❌	✅	✅
Edit design	Edit a design	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Delete a design	Delete a design	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Evaluate Relationships	Evaluate relationships inside a design	✅	✅	❌	❌	✅	❌	✅	✅
Download a design	Download a Meshery design in OCI or YAML format	✅	✅	❌	❌	✅	❌	✅	✅

Filters Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Filters	View all public and published filters of other team members and private of signed-in user	✅	✅	❌	❌	✅	❌	✅	✅
Publish WASM Filter	Publish WASM Filter	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Unpublish WASM Filter	Unpublish WASM Filter	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Import Filter	Import a filter	✅	✅	❌	❌	✅	❌	✅	✅
Download a WASM filter	Download a WASM filter	✅	✅	❌	❌	✅	❌	✅	✅
Details of WASM Filter	Check information or details of a WASM filter	✅	✅	❌	❌	✅	❌	✅	✅
Edit WASM filter	Edit WASM filter	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Clone WASM Filter	Clone WASM filter from catalog, which allows customizing filter and use it in design	✅	✅	❌	❌	✅	❌	✅	✅
Delete WASM Filter	Delete WASM filter permanently from catalog.	✅ *	✅ *	❌	❌	✅	❌	✅	✅

Catalog Requests Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Catalog Requests	View the catalog publication request queue	❌	❌	❌	❌	✅	❌	✅	✅
Approve Catalog Request	Approve catalog publication requests	❌	❌	❌	❌	✅	❌	✅	✅
Deny Catalog Request	Deny catalog publication requests	❌	❌	❌	❌	✅	❌	✅	✅

Content Items Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Content Items	View the content items of the organization	✅	✅	❌	❌	✅	❌	✅	✅
Create Content Item	Create a content item in the organization	✅	✅	❌	❌	✅	❌	✅	✅
Edit Content Item	Edit a content item of the organization	✅	✅	❌	❌	✅	❌	✅	✅
Delete Content Item	Delete a content item of the organization	✅	✅	❌	❌	✅	❌	✅	✅

Extensions Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Install extension	Install or enable or disabble extensions in Meshery	❌	❌	❌	❌	❌	❌	✅	✅
View Meshery User Preferences	View all user preferences in Meshery UI	✅	✅	❌	❌	✅	❌	✅	✅
View Extensions	View all extensions on the extension page	✅	✅	❌	❌	✅	❌	✅	✅

Users Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View All Kubernetes Clusters	View all configured Kubernetes clusters	✅	✅	❌	❌	✅	❌	✅	✅
Leave Team	Leave a team	✅	✅	❌	❌	✅	❌	❌	✅

Teams Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Team	See only teams to which you are a member. See all other members within those teams.	✅	✅	❌	❌	✅	❌	✅	✅
View Teams	See all teams of which you are an administrator. See all members of those teams.	❌	✅	❌	❌	✅	❌	✅	✅
View All Teams	See all teams within an organization. See all members of all teams.	✅	✅	❌	❌	✅	❌	✅	✅
Add User to Team	Directly create a new user account within a team.	❌	✅	❌	❌	❌	❌	✅	✅
Invite User to Team	Send a request for a user to join a team.	❌	✅	❌	❌	❌	❌	✅	✅
Remove User from Team	Discontinue user membership of a team and team resources.	❌	✅	❌	❌	❌	❌	✅	✅
Create Team	Establish new team for organizing groups of users and resource access.	❌	✅	❌	❌	❌	❌	✅	✅
Delete Team	Dissolve a team and all user memberships. Leave associated resources intact.	❌	✅	❌	❌	❌	❌	✅	✅
Edit Team	Edit a team and add new members to it.	❌	✅	❌	❌	❌	❌	✅	✅
Remove Roles from Team members	Remove roles from users in a team.	❌	✅	❌	❌	✅	❌	✅	✅
Assign Roles to Team members	Assign roles to users in a team	❌	✅	❌	❌	✅	❌	✅	✅
Open Team Invite	This governs the team's invitation permissions, determining whether the team is allowed to extend invitations to new individuals to join through open invite link.	❌	✅	❌	❌	✅	❌	✅	✅

Organizations Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Create Organization	Establish new organization for organizing teams, users, and resource access.	❌	❌	❌	❌	❌	❌	✅	✅
Edit Organization	Edit organiaztions and add teams to it	❌	❌	❌	❌	❌	❌	✅	✅
Add User to Organization	Directly create a new user account within an organization.	❌	❌	❌	❌	❌	✅	✅	✅
Invite User to Organization	Send a request for a user to join an organization.	❌	❌	❌	❌	❌	✅	✅	✅
Remove User from Organization	Discontinue user access to organization, teams and resources; cease billing accrual.	❌	❌	❌	❌	❌	✅	✅	✅
Promote or Demote User to Org Admin	Elevate or remove organization level administrative privileges.	❌	❌	❌	❌	❌	✅	✅	✅
View Org	See only organizations to which you are a member. See all other members within your membership teams.	✅	✅	❌	❌	✅	✅	✅	✅
View Organizations	See all organizations of which you are an administrator. See all members of those organizations.	❌	❌	❌	❌	❌	✅	✅	✅
View All Organizations	See all organizations within a Cloud deployment. See all organizations, teams, and users.	❌	❌	❌	❌	❌	❌	✅	✅
Remove Roles from Organization members	Remove roles from users in an organization	❌	❌	❌	❌	❌	❌	✅	✅
Assign Roles to Organization members	Assign roles to users in an organization	❌	❌	❌	❌	❌	❌	✅	✅

Connections Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Add cluster	Add Kubernetes cluster	❌	❌	❌	❌	✅	❌	✅	✅
Change connection state	Change connection state	❌	❌	❌	❌	✅	❌	✅	✅
Flush Meshsync data	Clearing the database by clicking on the `Flush MeshSync`	❌	❌	❌	❌	✅	❌	✅	✅
Register discovered Meshsync resource	Register discovered Meshsync resource to change state to connection	❌	❌	❌	❌	✅	❌	✅	✅
Delete a connection	Delete a connection	❌	❌	❌	❌	✅	❌	✅	✅
View Connections	View all connections within an environment	✅	✅	❌	❌	✅	❌	✅	✅

Settings Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Settings	View settings in Meshery	✅	✅	❌	❌	✅	❌	✅	✅
Connect adapter	Configure and connect to Meshery adapters	❌	❌	❌	❌	❌	❌	✅	✅
Connect Metrics	Configure and connect to metrics like Grafana and Promethues	❌	❌	❌	❌	❌	❌	✅	✅
View Metrics	View already configured metrics	✅	✅	❌	❌	✅	❌	✅	✅
View Registry	Explore entities within capabilities registry	✅	✅	❌	❌	✅	❌	✅	✅
Reset Database	Reset Meshery database	❌	❌	❌	❌	❌	❌	✅	✅

Performance Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Add performace profile	Add a new performace profile	❌	❌	❌	❌	❌	❌	✅	✅
Run test	Run a test on performance profile	❌	❌	❌	❌	❌	❌	✅	✅
View Results	View results of performance tests	✅	✅	❌	❌	✅	❌	✅	✅
Edit performance test	Edit performance test	❌	❌	❌	❌	❌	❌	✅	✅
Delete performance test	Delete performance test	❌	❌	❌	❌	❌	❌	✅	✅
View performance profiles	View all performance profiles	✅	✅	❌	❌	✅	❌	✅	✅

Cloud native infrastructure lifecycle Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Manage cloud native infrastructure life cycle	This permission grants the user the ability to manage infrastructure life cycles within meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.	❌	❌	❌	❌	❌	❌	✅	✅
Manage cloud native infrastructure configuration	Manage configuration for applications like EmojiVoto, HTTPBin, Image Hub, Istio Book Info	❌	❌	❌	❌	❌	❌	✅	✅
Apply cloud native infrastructure configuration	Configure infrastructure with some predefined options like Automatic Sidecar injection, Envoy Filter, Policy	❌	❌	❌	❌	❌	❌	✅	✅
Validate cloud native infrastructure configuration	Validate cloud native infrastructure configuration against best practices like Analyze Running Configuration, SMI conformance	❌	❌	❌	❌	❌	❌	✅	✅
Apply custom cloud native configuration	This permission grants the user the ability to apply custom configuration and customize existing configuration of thier cloud native infrastructure	❌	❌	❌	❌	❌	❌	✅	✅
Deploy cloud native infrastructure	This permission grants the user the ability to deploy their infrastructure to a cluster through Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies	❌	❌	❌	❌	❌	❌	✅	✅
Undeploy cloud native infrastructure	This permission grants the user the ability to undeploy their infrastructure from a cluster through Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies	❌	❌	❌	❌	❌	❌	✅	✅
View cloud native infrastructure	This permission grants the user the ability to view all cloud native infrastructure in Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.	✅	✅	❌	❌	✅	❌	✅	✅

Environments Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Environment	See all environments within an workspace.	✅	✅	❌	❌	✅	❌	✅	✅
Create Environment	Create a new environment	❌	❌	❌	❌	✅	❌	✅	✅
Delete Environment	Dissolve environment and all connection memberships. Leave associated resources intact.	❌	❌	❌	❌	✅	❌	✅	✅
Edit Environment	Edit environment and it connection membership	❌	❌	❌	❌	✅	❌	✅	✅
Assign connections to environment	Add new connections to environments	❌	❌	❌	❌	✅	❌	✅	✅
Remove connections from environment	Remove connections from environment,	❌	❌	❌	❌	✅	❌	✅	✅

Workspace Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Workspace	See all workspaces within an organization	✅	✅	❌	❌	✅	❌	✅	✅
Delete Workspace	Dissolve workspace and all team and environment memberships. Leave associated resources intact	❌	❌	❌	❌	✅	❌	✅	✅
Edit Workspace	Edit workspace and it's team and environment membership	❌	❌	❌	❌	✅	❌	✅	✅
Create Workspace	Create new workspace	❌	❌	❌	❌	✅	❌	✅	✅
Assign team to workspace	Add new team to workspace	❌	❌	❌	❌	✅	❌	✅	✅
Remove team from workspace	Remove team from workspace	❌	❌	❌	❌	✅	❌	✅	✅
Assign environment to workspace	Add new environment to workspace	❌	❌	❌	❌	✅	❌	✅	✅
Remove environment from workspace	Remove environment from workspace	❌	❌	❌	❌	✅	❌	✅	✅
Assign Designs to Workspaces	Assign designs to workspaces	❌	❌	❌	❌	✅	❌	✅	✅
Remove Designs from Workspaces	Remove designs from workspaces	❌	❌	❌	❌	✅	❌	✅	✅

Administration Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Academy Metrics	View and assess the performance of learners and of your organization's academy content.	❌	❌	❌	❌	❌	❌	❌	❌

Operator Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Views	See all views within a workspace	✅	✅	❌	❌	✅	❌	✅	✅
Delete View	Dissolve environment and all connection memberships. Leave associated resources intact.	✅ *	✅ *	❌	❌	✅	❌	✅	✅
Assign Views to Workspace	Add new views to workspace	❌	❌	❌	❌	✅	❌	✅	✅
Unassign Views from Workspace	Remove views from workspace	❌	❌	❌	❌	✅	❌	✅	✅

Credentials Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Credentials		❌	❌	❌	❌	❌	❌	✅	✅

Tokens Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Download Token		✅	✅	❌	❌	✅	❌	✅	✅

Roles Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
Assign User Roles		❌	❌	❌	❌	❌	❌	✅	✅

Claims Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Claims	See the claims in your organization, active and past, and which connection and member holds each.	✅	✅	❌	❌	✅	❌	✅	✅
Take and renew claims	Take a claim on a resource of your organization with one of your own connections, and renew it.	✅	✅	❌	❌	✅	❌	✅	✅
Release claim	Release a claim you hold and record its outcome.	✅	✅	❌	❌	✅	❌	✅	✅
Release claims of other members	Release a claim another member of your organization holds, for example a hold left by a computer that went offline.	❌	❌	❌	❌	❌	❌	✅	✅

Schedules Permissions

Permission	Description	User	Team Admin	Academy Admin	Leaner	Workspace Admin	Org Billing Manager	Org Admin	Provider Admin
View Schedules	View the schedules of the organization, when each runs next and which connection holds each one	✅	✅	❌	❌	✅	❌	✅	✅
Create schedule	Create a schedule in the organization	✅	✅	❌	❌	✅	❌	✅	✅
Edit schedule	Change a schedule of the organization, including pausing and resuming it	✅	✅	❌	❌	✅	❌	✅	✅
Delete schedule	Delete a schedule of the organization	✅	✅	❌	❌	✅	❌	✅	✅
Assign schedules to workspaces	Link a schedule of the organization to a workspace, or remove the link	✅	✅	❌	❌	✅	❌	✅	✅

Team Admin Role

Permission	Description
Share Design	Share design with anyone within your organization, and make your design easily accessible to all relevant team members.
Clone Design	Clone any published design to customise it according to your use cases
View Designs	View all public and published designs of other team members and private of signed-in user
View Filters	View all public and published filters of other team members and private of signed-in user
Publish WASM Filter	Publish WASM Filter
Unpublish WASM Filter	Unpublish WASM Filter
Create new design	Create new Meshery design
Import Design	Import a design
Publish Design	Publish a design
Unpublish Design	Unpublish a design
Validate Design	Validate a design
Details of design	Set design information or details of a design
Edit design	Edit a design
Delete a design	Delete a design
Evaluate Relationships	Evaluate relationships inside a design
Download a design	Download a Meshery design in OCI or YAML format
Import Filter	Import a filter
Download a WASM filter	Download a WASM filter
Details of WASM Filter	Check information or details of a WASM filter
Edit WASM filter	Edit WASM filter
Clone WASM Filter	Clone WASM filter from catalog, which allows customizing filter and use it in design
Delete WASM Filter	Delete WASM filter permanently from catalog.
View Content Items	View the content items of the organization
Create Content Item	Create a content item in the organization
Edit Content Item	Edit a content item of the organization
Delete Content Item	Delete a content item of the organization
View Meshery User Preferences	View all user preferences in Meshery UI
View Extensions	View all extensions on the extension page
View All Kubernetes Clusters	View all configured Kubernetes clusters
Leave Team	Leave a team
View Team	See only teams to which you are a member. See all other members within those teams.
View Teams	See all teams of which you are an administrator. See all members of those teams.
View All Teams	See all teams within an organization. See all members of all teams.
Add User to Team	Directly create a new user account within a team.
Invite User to Team	Send a request for a user to join a team.
Remove User from Team	Discontinue user membership of a team and team resources.
Create Team	Establish new team for organizing groups of users and resource access.
Delete Team	Dissolve a team and all user memberships. Leave associated resources intact.
Edit Team	Edit a team and add new members to it.
Remove Roles from Team members	Remove roles from users in a team.
Assign Roles to Team members	Assign roles to users in a team
Open Team Invite	This governs the team's invitation permissions, determining whether the team is allowed to extend invitations to new individuals to join through open invite link.
View Org	See only organizations to which you are a member. See all other members within your membership teams.
View Settings	View settings in Meshery
View Metrics	View already configured metrics
View Registry	Explore entities within capabilities registry
View Results	View results of performance tests
View performance profiles	View all performance profiles
View cloud native infrastructure	This permission grants the user the ability to view all cloud native infrastructure in Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.
View Connections	View all connections within an environment
View Environment	See all environments within an workspace.
View Catalog	View all items in catalog
View Workspace	See all workspaces within an organization
View Views	See all views within a workspace
Delete View	Dissolve environment and all connection memberships. Leave associated resources intact.
Download Token
View Claims	See the claims in your organization, active and past, and which connection and member holds each.
Take and renew claims	Take a claim on a resource of your organization with one of your own connections, and renew it.
Release claim	Release a claim you hold and record its outcome.
View Schedules	View the schedules of the organization, when each runs next and which connection holds each one
Create schedule	Create a schedule in the organization
Edit schedule	Change a schedule of the organization, including pausing and resuming it
Delete schedule	Delete a schedule of the organization
Assign schedules to workspaces	Link a schedule of the organization to a workspace, or remove the link

Academy Admin Role

Permission	Description

Leaner Role

Permission	Description

Workspace Admin Role

Permission	Description
Share Design	Share design with anyone within your organization, and make your design easily accessible to all relevant team members.
Clone Design	Clone any published design to customise it according to your use cases
View Designs	View all public and published designs of other team members and private of signed-in user
View Filters	View all public and published filters of other team members and private of signed-in user
Publish WASM Filter	Publish WASM Filter
Unpublish WASM Filter	Unpublish WASM Filter
View Catalog Requests	View the catalog publication request queue
Approve Catalog Request	Approve catalog publication requests
Deny Catalog Request	Deny catalog publication requests
Create new design	Create new Meshery design
Import Design	Import a design
Publish Design	Publish a design
Unpublish Design	Unpublish a design
Validate Design	Validate a design
Deploy Design	Deploy a design
Undeploy Design	Retract all resources used in a Meshery design from the cluster
Details of design	Set design information or details of a design
Edit design	Edit a design
Delete a design	Delete a design
Evaluate Relationships	Evaluate relationships inside a design
Download a design	Download a Meshery design in OCI or YAML format
Import Filter	Import a filter
Download a WASM filter	Download a WASM filter
Details of WASM Filter	Check information or details of a WASM filter
Edit WASM filter	Edit WASM filter
Clone WASM Filter	Clone WASM filter from catalog, which allows customizing filter and use it in design
Delete WASM Filter	Delete WASM filter permanently from catalog.
View Content Items	View the content items of the organization
Create Content Item	Create a content item in the organization
Edit Content Item	Edit a content item of the organization
Delete Content Item	Delete a content item of the organization
View Meshery User Preferences	View all user preferences in Meshery UI
View Extensions	View all extensions on the extension page
View All Kubernetes Clusters	View all configured Kubernetes clusters
Leave Team	Leave a team
View Team	See only teams to which you are a member. See all other members within those teams.
View Teams	See all teams of which you are an administrator. See all members of those teams.
View All Teams	See all teams within an organization. See all members of all teams.
Remove Roles from Team members	Remove roles from users in a team.
Assign Roles to Team members	Assign roles to users in a team
Open Team Invite	This governs the team's invitation permissions, determining whether the team is allowed to extend invitations to new individuals to join through open invite link.
View Org	See only organizations to which you are a member. See all other members within your membership teams.
Add cluster	Add Kubernetes cluster
Change connection state	Change connection state
Flush Meshsync data	Clearing the database by clicking on the `Flush MeshSync`
Register discovered Meshsync resource	Register discovered Meshsync resource to change state to connection
Delete a connection	Delete a connection
View Settings	View settings in Meshery
View Metrics	View already configured metrics
View Registry	Explore entities within capabilities registry
View Results	View results of performance tests
View performance profiles	View all performance profiles
View cloud native infrastructure	This permission grants the user the ability to view all cloud native infrastructure in Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.
View Connections	View all connections within an environment
View Environment	See all environments within an workspace.
Create Environment	Create a new environment
Delete Environment	Dissolve environment and all connection memberships. Leave associated resources intact.
Edit Environment	Edit environment and it connection membership
Assign connections to environment	Add new connections to environments
Remove connections from environment	Remove connections from environment,
View Catalog	View all items in catalog
View Workspace	See all workspaces within an organization
Delete Workspace	Dissolve workspace and all team and environment memberships. Leave associated resources intact
Edit Workspace	Edit workspace and it's team and environment membership
Create Workspace	Create new workspace
Assign team to workspace	Add new team to workspace
Remove team from workspace	Remove team from workspace
Assign environment to workspace	Add new environment to workspace
Remove environment from workspace	Remove environment from workspace
Assign Designs to Workspaces	Assign designs to workspaces
Remove Designs from Workspaces	Remove designs from workspaces
View Views	See all views within a workspace
Delete View	Dissolve environment and all connection memberships. Leave associated resources intact.
Assign Views to Workspace	Add new views to workspace
Unassign Views from Workspace	Remove views from workspace
Download Token
View Claims	See the claims in your organization, active and past, and which connection and member holds each.
Take and renew claims	Take a claim on a resource of your organization with one of your own connections, and renew it.
Release claim	Release a claim you hold and record its outcome.
View Schedules	View the schedules of the organization, when each runs next and which connection holds each one
Create schedule	Create a schedule in the organization
Edit schedule	Change a schedule of the organization, including pausing and resuming it
Delete schedule	Delete a schedule of the organization
Assign schedules to workspaces	Link a schedule of the organization to a workspace, or remove the link

Org Billing Manager Role

Permission	Description
Add User to Organization	Directly create a new user account within an organization.
Invite User to Organization	Send a request for a user to join an organization.
Remove User from Organization	Discontinue user access to organization, teams and resources; cease billing accrual.
Promote or Demote User to Org Admin	Elevate or remove organization level administrative privileges.
View Org	See only organizations to which you are a member. See all other members within your membership teams.
View Organizations	See all organizations of which you are an administrator. See all members of those organizations.

Org Admin Role

Permission	Description
Share Design	Share design with anyone within your organization, and make your design easily accessible to all relevant team members.
Clone Design	Clone any published design to customise it according to your use cases
View Designs	View all public and published designs of other team members and private of signed-in user
View Filters	View all public and published filters of other team members and private of signed-in user
Publish WASM Filter	Publish WASM Filter
Unpublish WASM Filter	Unpublish WASM Filter
View Catalog Requests	View the catalog publication request queue
Approve Catalog Request	Approve catalog publication requests
Deny Catalog Request	Deny catalog publication requests
Create new design	Create new Meshery design
Import Design	Import a design
Publish Design	Publish a design
Unpublish Design	Unpublish a design
Validate Design	Validate a design
Deploy Design	Deploy a design
Undeploy Design	Retract all resources used in a Meshery design from the cluster
Details of design	Set design information or details of a design
Edit design	Edit a design
Delete a design	Delete a design
Evaluate Relationships	Evaluate relationships inside a design
Download a design	Download a Meshery design in OCI or YAML format
Import Filter	Import a filter
Download a WASM filter	Download a WASM filter
Details of WASM Filter	Check information or details of a WASM filter
Edit WASM filter	Edit WASM filter
Clone WASM Filter	Clone WASM filter from catalog, which allows customizing filter and use it in design
Delete WASM Filter	Delete WASM filter permanently from catalog.
View Content Items	View the content items of the organization
Create Content Item	Create a content item in the organization
Edit Content Item	Edit a content item of the organization
Delete Content Item	Delete a content item of the organization
Install extension	Install or enable or disabble extensions in Meshery
View Meshery User Preferences	View all user preferences in Meshery UI
View Extensions	View all extensions on the extension page
View All Kubernetes Clusters	View all configured Kubernetes clusters
View Team	See only teams to which you are a member. See all other members within those teams.
View Teams	See all teams of which you are an administrator. See all members of those teams.
View All Teams	See all teams within an organization. See all members of all teams.
Add User to Team	Directly create a new user account within a team.
Invite User to Team	Send a request for a user to join a team.
Remove User from Team	Discontinue user membership of a team and team resources.
Create Team	Establish new team for organizing groups of users and resource access.
Delete Team	Dissolve a team and all user memberships. Leave associated resources intact.
Edit Team	Edit a team and add new members to it.
Remove Roles from Team members	Remove roles from users in a team.
Assign Roles to Team members	Assign roles to users in a team
Open Team Invite	This governs the team's invitation permissions, determining whether the team is allowed to extend invitations to new individuals to join through open invite link.
Create Organization	Establish new organization for organizing teams, users, and resource access.
Edit Organization	Edit organiaztions and add teams to it
Add User to Organization	Directly create a new user account within an organization.
Invite User to Organization	Send a request for a user to join an organization.
Remove User from Organization	Discontinue user access to organization, teams and resources; cease billing accrual.
Promote or Demote User to Org Admin	Elevate or remove organization level administrative privileges.
View Org	See only organizations to which you are a member. See all other members within your membership teams.
View Organizations	See all organizations of which you are an administrator. See all members of those organizations.
View All Organizations	See all organizations within a Cloud deployment. See all organizations, teams, and users.
Remove Roles from Organization members	Remove roles from users in an organization
Assign Roles to Organization members	Assign roles to users in an organization
Add cluster	Add Kubernetes cluster
Change connection state	Change connection state
Flush Meshsync data	Clearing the database by clicking on the `Flush MeshSync`
Register discovered Meshsync resource	Register discovered Meshsync resource to change state to connection
Delete a connection	Delete a connection
View Settings	View settings in Meshery
Connect adapter	Configure and connect to Meshery adapters
Connect Metrics	Configure and connect to metrics like Grafana and Promethues
View Metrics	View already configured metrics
View Registry	Explore entities within capabilities registry
Add performace profile	Add a new performace profile
Run test	Run a test on performance profile
View Results	View results of performance tests
Edit performance test	Edit performance test
Delete performance test	Delete performance test
View performance profiles	View all performance profiles
Manage cloud native infrastructure life cycle	This permission grants the user the ability to manage infrastructure life cycles within meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.
Manage cloud native infrastructure configuration	Manage configuration for applications like EmojiVoto, HTTPBin, Image Hub, Istio Book Info
Apply cloud native infrastructure configuration	Configure infrastructure with some predefined options like Automatic Sidecar injection, Envoy Filter, Policy
Validate cloud native infrastructure configuration	Validate cloud native infrastructure configuration against best practices like Analyze Running Configuration, SMI conformance
Apply custom cloud native configuration	This permission grants the user the ability to apply custom configuration and customize existing configuration of thier cloud native infrastructure
Deploy cloud native infrastructure	This permission grants the user the ability to deploy their infrastructure to a cluster through Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies
Undeploy cloud native infrastructure	This permission grants the user the ability to undeploy their infrastructure from a cluster through Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies
View cloud native infrastructure	This permission grants the user the ability to view all cloud native infrastructure in Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.
View Connections	View all connections within an environment
View Environment	See all environments within an workspace.
Create Environment	Create a new environment
Delete Environment	Dissolve environment and all connection memberships. Leave associated resources intact.
Edit Environment	Edit environment and it connection membership
Assign connections to environment	Add new connections to environments
Remove connections from environment	Remove connections from environment,
View Catalog	View all items in catalog
View Workspace	See all workspaces within an organization
Delete Workspace	Dissolve workspace and all team and environment memberships. Leave associated resources intact
Edit Workspace	Edit workspace and it's team and environment membership
Create Workspace	Create new workspace
Assign team to workspace	Add new team to workspace
Remove team from workspace	Remove team from workspace
Assign environment to workspace	Add new environment to workspace
Remove environment from workspace	Remove environment from workspace
Assign Designs to Workspaces	Assign designs to workspaces
Remove Designs from Workspaces	Remove designs from workspaces
Reset Database	Reset Meshery database
View Views	See all views within a workspace
Delete View	Dissolve environment and all connection memberships. Leave associated resources intact.
Assign Views to Workspace	Add new views to workspace
Unassign Views from Workspace	Remove views from workspace
View Credentials
Download Token
Assign User Roles
View Claims	See the claims in your organization, active and past, and which connection and member holds each.
Take and renew claims	Take a claim on a resource of your organization with one of your own connections, and renew it.
Release claim	Release a claim you hold and record its outcome.
Release claims of other members	Release a claim another member of your organization holds, for example a hold left by a computer that went offline.
View Schedules	View the schedules of the organization, when each runs next and which connection holds each one
Create schedule	Create a schedule in the organization
Edit schedule	Change a schedule of the organization, including pausing and resuming it
Delete schedule	Delete a schedule of the organization
Assign schedules to workspaces	Link a schedule of the organization to a workspace, or remove the link

Provider Admin Role

Permission	Description
Share Design	Share design with anyone within your organization, and make your design easily accessible to all relevant team members.
Clone Design	Clone any published design to customise it according to your use cases
View Designs	View all public and published designs of other team members and private of signed-in user
View Filters	View all public and published filters of other team members and private of signed-in user
Publish WASM Filter	Publish WASM Filter
Unpublish WASM Filter	Unpublish WASM Filter
View Catalog Requests	View the catalog publication request queue
Approve Catalog Request	Approve catalog publication requests
Deny Catalog Request	Deny catalog publication requests
Create new design	Create new Meshery design
Import Design	Import a design
Publish Design	Publish a design
Unpublish Design	Unpublish a design
Validate Design	Validate a design
Deploy Design	Deploy a design
Undeploy Design	Retract all resources used in a Meshery design from the cluster
Details of design	Set design information or details of a design
Edit design	Edit a design
Delete a design	Delete a design
Evaluate Relationships	Evaluate relationships inside a design
Download a design	Download a Meshery design in OCI or YAML format
Import Filter	Import a filter
Download a WASM filter	Download a WASM filter
Details of WASM Filter	Check information or details of a WASM filter
Edit WASM filter	Edit WASM filter
Clone WASM Filter	Clone WASM filter from catalog, which allows customizing filter and use it in design
Delete WASM Filter	Delete WASM filter permanently from catalog.
View Content Items	View the content items of the organization
Create Content Item	Create a content item in the organization
Edit Content Item	Edit a content item of the organization
Delete Content Item	Delete a content item of the organization
Install extension	Install or enable or disabble extensions in Meshery
View Meshery User Preferences	View all user preferences in Meshery UI
View Extensions	View all extensions on the extension page
View All Kubernetes Clusters	View all configured Kubernetes clusters
Leave Team	Leave a team
View Team	See only teams to which you are a member. See all other members within those teams.
View Teams	See all teams of which you are an administrator. See all members of those teams.
View All Teams	See all teams within an organization. See all members of all teams.
Add User to Team	Directly create a new user account within a team.
Invite User to Team	Send a request for a user to join a team.
Remove User from Team	Discontinue user membership of a team and team resources.
Create Team	Establish new team for organizing groups of users and resource access.
Delete Team	Dissolve a team and all user memberships. Leave associated resources intact.
Edit Team	Edit a team and add new members to it.
Remove Roles from Team members	Remove roles from users in a team.
Assign Roles to Team members	Assign roles to users in a team
Open Team Invite	This governs the team's invitation permissions, determining whether the team is allowed to extend invitations to new individuals to join through open invite link.
Create Organization	Establish new organization for organizing teams, users, and resource access.
Edit Organization	Edit organiaztions and add teams to it
Add User to Organization	Directly create a new user account within an organization.
Invite User to Organization	Send a request for a user to join an organization.
Remove User from Organization	Discontinue user access to organization, teams and resources; cease billing accrual.
Promote or Demote User to Org Admin	Elevate or remove organization level administrative privileges.
View Org	See only organizations to which you are a member. See all other members within your membership teams.
View Organizations	See all organizations of which you are an administrator. See all members of those organizations.
View All Organizations	See all organizations within a Cloud deployment. See all organizations, teams, and users.
Remove Roles from Organization members	Remove roles from users in an organization
Assign Roles to Organization members	Assign roles to users in an organization
Add cluster	Add Kubernetes cluster
Change connection state	Change connection state
Flush Meshsync data	Clearing the database by clicking on the `Flush MeshSync`
Register discovered Meshsync resource	Register discovered Meshsync resource to change state to connection
Delete a connection	Delete a connection
View Settings	View settings in Meshery
Connect adapter	Configure and connect to Meshery adapters
Connect Metrics	Configure and connect to metrics like Grafana and Promethues
View Metrics	View already configured metrics
View Registry	Explore entities within capabilities registry
Add performace profile	Add a new performace profile
Run test	Run a test on performance profile
View Results	View results of performance tests
Edit performance test	Edit performance test
Delete performance test	Delete performance test
View performance profiles	View all performance profiles
Manage cloud native infrastructure life cycle	This permission grants the user the ability to manage infrastructure life cycles within meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.
Manage cloud native infrastructure configuration	Manage configuration for applications like EmojiVoto, HTTPBin, Image Hub, Istio Book Info
Apply cloud native infrastructure configuration	Configure infrastructure with some predefined options like Automatic Sidecar injection, Envoy Filter, Policy
Validate cloud native infrastructure configuration	Validate cloud native infrastructure configuration against best practices like Analyze Running Configuration, SMI conformance
Apply custom cloud native configuration	This permission grants the user the ability to apply custom configuration and customize existing configuration of thier cloud native infrastructure
Deploy cloud native infrastructure	This permission grants the user the ability to deploy their infrastructure to a cluster through Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies
Undeploy cloud native infrastructure	This permission grants the user the ability to undeploy their infrastructure from a cluster through Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies
View cloud native infrastructure	This permission grants the user the ability to view all cloud native infrastructure in Meshery. Meshery allows users to visualize, work on and manage various cloud native technologies.
View Connections	View all connections within an environment
View Environment	See all environments within an workspace.
Create Environment	Create a new environment
Delete Environment	Dissolve environment and all connection memberships. Leave associated resources intact.
Edit Environment	Edit environment and it connection membership
Assign connections to environment	Add new connections to environments
Remove connections from environment	Remove connections from environment,
View Catalog	View all items in catalog
View Workspace	See all workspaces within an organization
Delete Workspace	Dissolve workspace and all team and environment memberships. Leave associated resources intact
Edit Workspace	Edit workspace and it's team and environment membership
Create Workspace	Create new workspace
Assign team to workspace	Add new team to workspace
Remove team from workspace	Remove team from workspace
Assign environment to workspace	Add new environment to workspace
Remove environment from workspace	Remove environment from workspace
Assign Designs to Workspaces	Assign designs to workspaces
Remove Designs from Workspaces	Remove designs from workspaces
Reset Database	Reset Meshery database
View Views	See all views within a workspace
Delete View	Dissolve environment and all connection memberships. Leave associated resources intact.
Assign Views to Workspace	Add new views to workspace
Unassign Views from Workspace	Remove views from workspace
View Credentials
Download Token
Assign User Roles
View Claims	See the claims in your organization, active and past, and which connection and member holds each.
Take and renew claims	Take a claim on a resource of your organization with one of your own connections, and renew it.
Release claim	Release a claim you hold and record its outcome.
Release claims of other members	Release a claim another member of your organization holds, for example a hold left by a computer that went offline.
View Schedules	View the schedules of the organization, when each runs next and which connection holds each one
Create schedule	Create a schedule in the organization
Edit schedule	Change a schedule of the organization, including pausing and resuming it
Delete schedule	Delete a schedule of the organization
Assign schedules to workspaces	Link a schedule of the organization to a workspace, or remove the link

How permission checks work 🔗

A permission is a named key that allows one action, such as Create Team. A keychain groups keys, and a role groups keychains. Layer5 Cloud checks the key, never the role name. Before it runs a guarded action, Cloud resolves the organization the request names, then checks whether the user holds the key through a role in that organization. A user’s permissions are the union of the keys from every role the user holds there.

When a user lacks the key, Cloud refuses the request with HTTP 403 and the message “You do not hold the permission this action requires in this organization”. The response body is JSON with an error message and a code.

Provider Admin passes every permission check, in every organization.

Keys, keychains, and roles are defined once for the whole deployment. What varies per organization is which roles a user holds there. See Keys and Keychains.

Default roles 🔗

Role	Scope	Assigned by
Provider Admin	Provider	Provider Admin
Kanvas	Provider	Provider Admin. Every new account receives it automatically.
Curator	Provider	Provider Admin
Organization Admin	Organization	Organization Admin or Provider Admin
User	Organization	Organization Admin or Provider Admin
Workspace Admin	Organization	Organization Admin or Provider Admin
Workspace Manager	Organization	Organization Admin or Provider Admin
Academy Admin	Organization	Organization Admin or Provider Admin
Academy Learner	Organization	Organization Admin or Provider Admin
Team Admin	Team	Team Admin or Provider Admin

An anonymous user, someone using Kanvas without signing in, receives an internal Anonymous User role. It is not listed and cannot be assigned. See Kanvas reference for what anonymous users can do in Kanvas.

The Kanvas role holds no keychains. It makes the Kanvas extension available when a Meshery Server connects to Layer5 Cloud.

Roles the matrix columns do not cover 🔗

The tables above are refreshed from the Layer5 permission list (static/data/csv/keys.csv). A check mark means the role holds the permission. A check mark with an asterisk means the role holds the permission only on resources the user owns. A cross means the role does not hold the permission.

The spreadsheet includes columns for User, Team Admin, Academy Admin, Learner (headed Leaner), Workspace Admin, Org Billing Manager, Org Admin, and Provider Admin. These roles have no column:

Role	What it holds by default
Workspace Manager	The permissions of Workspace Admin for workspaces, environments, teams, and lifecycle actions, plus management of the designs, environments, and connections inside the workspaces where the user holds the role. It does not hold the catalog curation permissions.
Curator	No keychains in a default install. Organization Admin and Workspace Admin hold the catalog curation permissions, including approving and denying publish requests.
Kanvas	No keychains. See Default roles.
Anonymous User	The Kanvas design permissions for people who are not signed in.

Academy Admin holds the Academy management permissions, plus team management and workspace management. Academy Learner holds access to Academy content and registration. Both appear as columns in the tables above.

Default keychains 🔗

Layer5 Cloud ships 30 default keychains. Each groups the permissions for one area. Roles hold keychains, so granting a keychain to a role grants every permission in it. The system account owns the default keychains. Only a Provider Admin can change a keychain or assign one to a role, as of Layer5 Cloud v1.0.280.

Keychain	What it groups
User View	Permissions for individual users, including View Tokens, View Sessions, View Keys, and View Keychains.
User Management	Managing users and their roles.
Team View	Viewing teams and their members.
Team Management	Managing teams and team membership.
Organization Management	Managing organizations, their teams, and their users.
Events Management	Event management: statistics, audit, and summaries.
Security Management	Creating, downloading, and deleting API tokens, and managing credentials. Key and keychain management belongs to Provider Management. See security permission keys.

Layer5 Cloud also ships keychains for workspaces, environments, the catalog, lifecycle actions, extensions, settings, performance, views, collaboration, infrastructure, curation, the Academy, and the two Kanvas action sets (Designer Actions and Operator Actions). For keychain behavior, see Keychains.

Profile permissions 🔗

The profile permissions are not yet rows in the permission list. They are held by default as follows:

Permission	Held by
View Profiles	User, Team Admin, Workspace Admin, Organization Admin
Create Profile, Edit Profile, Delete Profile	Workspace Admin, Organization Admin
Assign profile to workspace, Remove profile from workspace	Workspace Admin, Academy Admin, Organization Admin

Provider Admin holds all six. The owner of a profile can read it without View Profiles, and can edit it and its connection links without Edit Profile. People using Kanvas without signing in hold none of them. See Profiles.

What the matrix does not show 🔗

Security keys. Token, session, key, and keychain keys are not all rows in this spreadsheet. See security permission keys.
Canvas editing. The permission list omits the per-edit Kanvas permissions, such as adding, deleting, and styling components. See Kanvas reference for which Kanvas actions check a permission.
Provider Admin. It holds every permission, including permissions that are not in the list.
Plan limits. A role grants a permission, and the plan decides whether the capability exists for the organization. See Feature availability by plan.

Custom roles 🔗

A custom role bundles keychains that the default roles do not combine. Only a Provider Admin can create, edit, or delete a custom role, or change an existing role. The server refuses everyone else with HTTP 403. On hosted Layer5 Cloud, Layer5 operates the Provider Admin role, so an organization cannot create custom roles itself. On a self-hosted deployment, the operator’s Provider Admins can.

Roles and keychains are defined for the whole Layer5 Cloud deployment, not per organization. Only a Provider Admin can create, edit, or delete a keychain, change its keys, or assign a keychain to a role. Changing the keychains of a role changes that role for every organization that uses it. See Roles.

The plan catalog lists Custom Roles and User-defined Roles as packaged capabilities. Layer5 Cloud does not check your plan when a custom role is created. It checks that the caller is a Provider Admin.