Enhanced RBAC Permission Reference

Use this reference to see what each permission grants, how access rights combine, and which related resources a feature also needs. For creating and editing roles in the UI, see Enhanced Role-Based Access Control (RBAC)Enhanced Role-Based Access Control (RBAC).

Choose Your Path

Goal	Where to go
Understand users, groups, roles, and how access is granted	How Permissions Are Structured
Look up what an access right means (Create, Execute, Bypass Restrictions, and so on)	Access Rights Glossary
See what an account-level resource permission controls	Account-Level Permissions
See what a tenant-level resource permission controls	Tenant-Level Permissions
Trace why a feature needs more than one permission	Cross-Resource Dependencies
Diagnose a user who cannot open a feature	Troubleshoot Access Issues
Plan a move from legacy RBAC	Move from Legacy RBAC to Enhanced RBAC

How Permissions Are Structured

Permissions are grouped into roles. Users get access through roles assigned to them or to their groups.

Core Concepts

Concept	Description
User	An identity that logs in and performs actions. Managed under Admin Panel → Users. The user must belong to the account and have at least one role.
Group	A collection of users used to assign roles and record restrictions. A user can belong to several groups; one may be the primary group. Groups can nest in a parent–child hierarchy.
Role	A named set of permissions assigned to users or groups. Roles are account-level: one role can grant access across multiple tenants. Managed under Admin Panel → Roles.
Resource	The item being secured, such as Applications, Application Records, Playbooks & Components, Users, or Roles.
Permission	An access rule on a resource. In the role editor, each permission is a resource row with one or more access rights selected.
Access right	The action allowed on a resource, such as Create, Read, Update, Delete, Execute, Restrict, or Lock. In Swimlane documentation these are also called permission actions.
External user	A user from another Swimlane account who is invited to this account. External users follow the same RBAC rules. Manage External on the Users resource controls who can administer external user accounts.

How Access Is Granted

A user can perform an action when all of the following are true:

The user is associated with the account (or invited as an external user).

A role is assigned to the user directly or to a group of which the user is a member.

That role includes the required permission (resource plus access right) for the action.

Permission level	Applies to
Account-level	Administrative resources across the whole account (for example, Users, Roles, Tenants).
Tenant-level	Operational resources in specific tenants or all tenants. The same role can grant different access in different tenants.

Group Role Assignment

A role assigned to a group applies only to direct members of that group. Roles are not propagated through the group hierarchy: if Group A is a child of Group B, each group's roles apply only to that group's own direct members.

Global Versus Resource-Level Access

Scope	Behavior
Global	Applies to all current and future instances of a resource type (for example, all dashboards).
Resource-level	Applies only to the individual instances you select.

When global access is selected, it overrides resource-level selections. Resource-level selections are retained and can be restored if you later prefer resource-level access over global.

Required Access and Auto-Check Behavior

Some access rights do not work alone. The role editor auto-checks related access rights when you select certain options.

When you check	The editor also checks
Create	Read, Update
Update	Read
Delete	Read, Update (Read only for Connectors, Connector Public Keys, and CA Certificates)
Export (Tenant)	Read
Import (Tenant)	Create, Read, Update
Execute (Playbook/Component)	Read
Test (Asset)	Read, Update
Install (Connector)	Read
Create Personal (Dashboard/Report)	Create, Read, Update
Override Locks	Read, Update, Lock
Restrict / Lock / Workflow History / Bypass Restrictions / Moderate Comments / Run Details	Read (plus Update for most)
Assign / Assign Roles	Read, Update
Update Membership (Group)	Read
Manage External (User)	Create, Read, Update, Delete

Auto-check runs only when you select an access right. Deselecting one right does not auto-deselect rights that were checked with it. What you save on the role is exactly what applies; there is no hidden logic that re-adds required access later.

Cross-resource dependencies are not auto-checked. For example, viewing a dashboard may also need Read on the reports it contains, and records need at least Read on the associated application. See Cross-Resource Dependencies.

Before you replace a role on working users, Copy Role and test with a non-production user. Confirm every required action end to end, then assign the role broadly.

Access Prerequisites

Before account and tenant permissions take effect:

The user must be associated with the account or invited as an external user.

The user must have a role (directly or through a group) that grants the needed permissions, including Tenants → Read to use resources inside a tenant.

Without both, the user cannot reach account resources and may be unable to log in.

Access Rights Glossary

These meanings are the same wherever the access right appears. Resource-specific notes appear in the account and tenant sections below.

Access right	What it lets the user do
Create	Create new instances of the resource.
Read	View or list the resource. Almost every other action requires Read.
Update	Modify an existing resource.
Delete	Remove the resource.
Export	(Tenant only, on Tenants) Export tenant content such as applications, applets, and playbooks.
Import	(Tenant only, on Tenants) Import content into a tenant.
Execute	Run the resource. For Playbooks & Components, run the playbook.
Test	(Assets) Run a connection or validation check. Selecting it also checks Read and Update.
Install	(Connectors) Install a connector. Replaces Create for connectors.
Restrict	(Records) Restrict a record so only selected users or groups can see it.
Lock	(Records) Lock a record to prevent concurrent edits.
Override Locks	(Records) Edit or unlock a record locked by another user.
Workflow History	(Records) View workflow run history for a record.
Bypass Restrictions	(Records, Dashboards, Reports) Act on a resource that is restricted to other users or groups, including restricted fields on application records. The user still needs Read (and Update to edit).
Moderate Comments	(Records) Edit or delete comments left by other users.
Run Details	(Playbooks & Components) View the detailed run log.
Create Personal	(Dashboards, Reports) Create personal items visible only to the creator or users with Bypass Restrictions.
Assign	(Roles) Assign a user or group to a role.
Assign Roles	(Users, Groups) Assign a role to a user or group.
Update Membership	(Groups) Change group members or group hierarchy.
Manage External	(Users) Manage external (shared-account) users.
Bulk Update Assets / Bulk Delete Assets	(Configuration Manager) Update or delete configuration assets in bulk.

Account-Level Permissions

Account-level permissions control administrative resources across the whole account.

Admin Panel

Access	Purpose
Read	Shows the Admin Panel menu and opens admin pages.

Admin Panel → Read is a gate, not a master key. Each admin page also needs permissions for that page's resource. For example, the Users page needs Admin Panel → Read plus Users → Read.

Account Settings

Access	Purpose
Read	View account settings under Admin Panel → Settings → Account.
Update	Change account settings (General, Security & Compliance, Directory Services, SSO/SAML, mail, license, Git integration).

Account Audit Logs

Access	Purpose
Read	Retrieve account audit log entries programmatically. There is no audit-log screen in the Admin Panel.

Usage

Access	Purpose
Read	View usage reporting in the Admin Panel. Separate from tenant application reports and dashboards.

Some Usage dashboards need an extra permission:

Dashboard	Also required
Hero AI (Credits, Prompts, Tokens) and Notifications	Usage → Read only
Playbook Runs and Actions	Playbooks & Components → Run Details (any tenant)
Events	Events → Read (any tenant)

Without the extra permission, that dashboard stays hidden even if Usage → Read is granted.

Tenants

Access	Purpose
Create, Read, Update, Delete	Manage tenants. Read is required to enter a tenant and reach its resources.
Export	Export tenant content. Also needs Read on each resource type included in the package. Unreadable items are omitted.
Import	Import tenant content. Also needs Create (new items) or Update (overwrite) on each resource type written.

Users

Access	Purpose
Read	View users in lists and pickers. Every user has implicit Read on their own user record.
Create, Update, Delete	Create, change, or remove users.
Assign Roles	Attach a role to a user.
Manage External	Manage external or shared users (also checks Create, Read, Update, Delete).

Read, Update, Delete, and Assign Roles can be granted on specific users (resource-level) for MSSP or multi-customer separation. Create is account-wide only.

Roles

Access	Purpose
Read	See and select roles where roles appear.
Create, Update, Delete	Create, change, or remove roles.
Assign	Grant a role to a user or group.

Read, Update, Delete, and Assign can be scoped to specific roles.

Inline permissions on other resources. Dashboards, Reports, Workspaces, Applications, and Applets expose a Permissions tab on their own screens:

Task	Required permissions
Open the Permissions tab (dashboards, reports, workspaces)	Roles → Read, or Create Personal alone when configuring a personal dashboard or report
Add or change a role in the picker	Roles → Update on each role listed
Save access on the resource	Update on that resource (for example, Reports → Update)

Full role editing remains under Admin Panel → Roles.

Groups

Access	Purpose
Read	See and select groups across the product.
Create, Update, Delete	Create, change, or remove groups.
Update Membership	Change group members and hierarchy.
Assign Roles	Add a role to the group.

Read, Update, Delete, and Assign Roles can be scoped to specific groups.

Configuration Manager

Access	Purpose
Read	Open Configuration Manager.
Bulk Update Assets / Bulk Delete Assets	Apply bulk changes to configuration assets.

Visible only when Configuration Manager is enabled for the account. A user with Configuration Manager → Read but without Admin Panel → Read gets a separate Configuration Manager entry under the user avatar.

Content (Library)

Access	Purpose
Create, Read, Update, Delete	Access the Library menu.

Library access is account-level only. Content cannot be restricted per tenant even when associated with a tenant.

Tenant-Level Permissions

Tenant-level permissions control operational resources. Configure them per tenant, or for all tenants. Global tenant permissions can be copied from one tenant to others. Resource-level selections cannot be copied across tenants and cannot be used with All tenants.

Applications

Access	Purpose
Create, Read, Update, Delete	Manage applications. Read is required for records, dashboards, and reports related to that application.

Inline access: Application settings → Administration configures per-role application access. The tab requires Application Records → Update. Changing role access also requires Roles → Update on each affected role.

Applets

Access	Purpose
Create, Read, Update, Delete	Manage applets.

Inline access: Applet Permissions tab requires Applets → Update plus Roles → Update on each affected role.

Application Records

Access	Purpose
Create, Read, Update, Delete	Manage records.
Restrict	Limit a record to selected users or groups.
Lock / Override Locks	Lock a record; override another user's lock (Override Locks also checks Lock).
Workflow History	View a record's workflow run history.
Bypass Restrictions	Open, edit, and delete records and fields that are otherwise restricted. Still needs Record → Read and Update for those actions. Can be global or per application.
Moderate Comments	Edit other users' comments on a record.

Depends on: Application → Read, and Playbook → Read plus Execute for playbook buttons on a record.

Inline access: Application settings → Records requires Application Records → Update plus Roles → Update on each affected role.

Field-level permissions (application builder → field Properties → Permissions) override application-level record permissions for that field. Only Read and Update can be granted per role.

Field-permission task	Required
Open app builder and save	Applications → Update on the application
Load roles in the picker	Account → Read and Roles → Read
Save field permission changes	Roles → Update on each role whose permissions changed

Dashboards

Access	Purpose
Create, Read, Update, Delete	Manage shared dashboards.
Create Personal	Create dashboards visible only to the creator (also checks Create, Read, Update).
Bypass Restrictions	View, edit, and delete dashboards the user is not on the access list for, including personal dashboards. Global only.

Depends on: Read on the applications, reports, and records the dashboard uses.

Inline access: Permissions tab opens with Dashboards → Create Personal or Roles → Read. Changing role access requires Roles → Update.

Reports

Access	Purpose
Create, Read, Update, Delete	Manage shared reports.
Create Personal	Same semantics as dashboards.
Bypass Restrictions	Same semantics as dashboards.

Depends on: applications and records the report draws from.

Inline access: Shared reports need Roles → Read and Reports → Update. Personal reports can open the tab with Create Personal alone. Changing role access requires Roles → Update.

Workspaces

Access	Purpose
Create, Read, Update, Delete	Manage workspaces.

Depends on: applications, dashboards, and records in the workspace.

Inline access: Requires Roles → Read and Workspaces → Update. Changing role access requires Roles → Update.

Home Page

Access	Purpose
Read	View other users' home pages (with Users → Read for that owner).
Update	Edit other users' home pages (with Users → Read for that owner).

Every user can view and configure their own home page without Home Page permission. Read and Update are account-wide only (not per-instance) and apply to other users' home pages and bulk home-page actions.

Playbooks & Components

Access	Purpose
Create, Read, Update, Delete	Author and manage playbooks and components.
Execute	Run a playbook or component (also checks Read).
Run Details	Open the detailed run log.

Read plus Execute are required to use playbook buttons on records.

Connectors

Access	Purpose
Install	Install a connector (also checks Read). Replaces Create.
Read, Delete	View and remove connectors. No Create or Update.

Connector Public Keys

Access	Purpose
Read	Show Connector Trust Keys under Tenant Settings and list keys.
Create / Delete	Add or remove a key.

Also needs Admin Panel → Read and Tenant Settings → Read to reach the UI.

Assets

Access	Purpose
Create, Read, Update, Delete	Manage assets used in playbooks and applications.
Test	Run a connection or validation check (also checks Read and Update).

Webhooks

Access	Purpose
Create, Read, Update, Delete	Manage webhook triggers while authoring playbooks.

Events

Access	Purpose
Read	Show the Events tab in Operational Health (Operational Health must be enabled; also needs Playbook → Create, Update, or Delete). Also required for Admin Panel → Usage → Events with Admin Panel → Read and Usage → Read.

Playbook Alerts

Access	Purpose
Read	View playbook alerts in Operational Health when that feature is enabled.

Pools

Access	Purpose
Read	List pools and open a pool.
Create / Update / Delete	Add, edit, or remove a pool. Delete also needs Remote Agent → Update and Playbook → Update.

Managed under Admin Panel → Settings → Tenant Settings (Nodes / Remote Agents). Needs Admin Panel → Read and Tenant Settings → Read. Selecting a pool inside a playbook action is not separately gated by Pool permission.

Remote Agents

Access	Purpose
Read	List agents and open details.
Update	Rename, enable or disable, and change pool assignments.
Delete	Remove an agent.
Create	Agents register when deployed with the install script; day-to-day management uses Read, Update, and Delete.

Same Tenant Settings page as pools. Deleting a pool needs Remote Agent → Update. Viewing a pool's linked agents needs Remote Agent → Read.

CA Certificates

Access	Purpose
Read	Show the CA Certificates tab and list certificates.
Create	Upload a PEM string or file.
Delete	Remove a certificate. No Update — replace by delete and create.

Managed under Tenant Settings. Distribution to remote agents when an agent is enabled uses Remote Agent → Update and does not require CA Certificate permission.

Tenant Settings

Access	Purpose
Read	Open Tenant Settings and see tenants in the selector. Also needs Tenants → Read.
Update	Save tenant settings.

Tab	Additional gate
System, Email & PDF	Tenant Settings Read / Update
Connector Trust Keys	Connector Public Key → Read
CA Certificates	CA Certificate → Read (Create/Delete for add/remove)
Agents (Remote Agents and Pools)	Remote Agent and Pool permissions
Features	Super admins or users allowed to manage tenant feature settings
Orchestration Alerts	Shown when Operational Health is enabled

Tenant Audit Logs

Access	Purpose
Read	Retrieve tenant audit logs programmatically. No UI.

Cross-Resource Dependencies

A parent resource never auto-grants its dependencies. Missing any link blocks the feature.

Goal	Also required
Read a record	Application → Read; Application Records → Read
See users or groups in user/group fields on a record	Users → Read and/or Groups → Read (account level). Names already stored may still display; unresolved entries can render blank
Run a playbook from a record	Playbook → Read and Execute
Use a dashboard, report, or workspace	Read on the applications, reports, and records they surface
Configure access on a resource's own screen	Update on that resource (or Create Personal for personal dashboards/reports); Roles → Update to change which roles have access
Set field-level permissions in the app builder	Applications → Update; Account → Read and Roles → Read to load roles; Roles → Update to save
Open any admin page	Admin Panel → Read plus the page's resource permission
Export tenant content	Tenants → Export plus Read on each exported resource
Import tenant content	Tenants → Import plus Create or Update on each imported resource

Troubleshoot Access Issues

Check	What to verify
1. Role assignment	Direct role assignment and group membership. Roles assigned to a group apply to direct members only.
2. Target resource	The role includes the required access right on the specific resource (and tenant, if tenant-level).
3. Dependent resources	Related permissions from Cross-Resource Dependencies. Record → Read alone does not unlock dashboards or playbook buttons.

For new or changed roles, copy the role and test with a non-production user before broad assignment.

Next Steps

Enhanced Role-Based Access Control (RBAC)Enhanced Role-Based Access Control (RBAC) — create and edit roles in the UI

Move from Legacy RBAC to Enhanced RBAC — migration mapping and support request

Test Connector Assets — Assets → Test permission

Configuration Manager — bulk asset actions and permissions