--- title: Enhanced RBAC Permission Reference slug: enhanced-rbac-permission-reference docTags: createdAt: 2026-07-13T13:28:00.243Z --- Use this reference to see what each permission grants, how access rights combine, and which related resources a feature also needs. For creating and editing roles in the UI, see [Enhanced Role-Based Access Control (RBAC)](docId:4c4ar7pxA6dE6TJ3DZB_S). ## Choose Your Path | **Goal** | **Where to go** | | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | | Understand users, groups, roles, and how access is granted | [How Permissions Are Structured](https://docs.swimlane.com/enhanced-rbac-permission-reference#how-permissions-are-structured) | | Look up what an access right means (Create, Execute, Bypass Restrictions, and so on) | [Access Rights Glossary](https://docs.swimlane.com/enhanced-rbac-permission-reference#access-rights-glossary) | | See what an account-level resource permission controls | [Account-Level Permissions](https://docs.swimlane.com/enhanced-rbac-permission-reference#account-level-permissions) | | See what a tenant-level resource permission controls | [Tenant-Level Permissions](https://docs.swimlane.com/enhanced-rbac-permission-reference#tenant-level-permissions) | | Trace why a feature needs more than one permission | [Cross-Resource Dependencies](https://docs.swimlane.com/enhanced-rbac-permission-reference#cross-resource-dependencies) | | Diagnose a user who cannot open a feature | [Troubleshoot Access Issues](https://docs.swimlane.com/enhanced-rbac-permission-reference#troubleshoot-access-issues) | | Plan a move from legacy RBAC | [Move from Legacy RBAC to Enhanced RBAC](https://docs.swimlane.com/move-from-legacy-rbac-to-enhanced-rbac) | ## How Permissions Are Structured Permissions are grouped into roles. Users get access through roles assigned to them or to their groups. ### Core Concepts | **Concept** | **Description** | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **User** | An identity that logs in and performs actions. Managed under **Admin Panel → Users**. The user must belong to the account and have at least one role. | | **Group** | A collection of users used to assign roles and record restrictions. A user can belong to several groups; one may be the primary group. Groups can nest in a parent–child hierarchy. | | **Role** | A named set of permissions assigned to users or groups. Roles are account-level: one role can grant access across multiple tenants. Managed under **Admin Panel → Roles**. | | **Resource** | The item being secured, such as Applications, Application Records, Playbooks & Components, Users, or Roles. | | **Permission** | An access rule on a resource. In the role editor, each permission is a resource row with one or more access rights selected. | | **Access right** | The action allowed on a resource, such as Create, Read, Update, Delete, Execute, Restrict, or Lock. In Swimlane documentation these are also called permission actions. | | **External user** | A user from another Swimlane account who is invited to this account. External users follow the same RBAC rules. **Manage External** on the Users resource controls who can administer external user accounts. | ### How Access Is Granted A user can perform an action when all of the following are true: 1. The user is associated with the account (or invited as an external user). 2. A role is assigned to the user directly or to a group of which the user is a member. 3. That role includes the required permission (resource plus access right) for the action. | **Permission level** | **Applies to** | | -------------------- | ------------------------------------------------------------------------------------------------------------------------ | | **Account-level** | Administrative resources across the whole account (for example, Users, Roles, Tenants). | | **Tenant-level** | Operational resources in specific tenants or all tenants. The same role can grant different access in different tenants. | ### Group Role Assignment A role assigned to a group applies only to **direct members** of that group. Roles are not propagated through the group hierarchy: if Group A is a child of Group B, each group's roles apply only to that group's own direct members. ### Global Versus Resource-Level Access | **Scope** | **Behavior** | | ------------------ | --------------------------------------------------------------------------------------------- | | **Global** | Applies to all current and future instances of a resource type (for example, all dashboards). | | **Resource-level** | Applies only to the individual instances you select. | When global access is selected, it overrides resource-level selections. Resource-level selections are retained and can be restored if you later prefer resource-level access over global. ### Required Access and Auto-Check Behavior Some access rights do not work alone. The role editor auto-checks related access rights when you select certain options. | **When you check** | **The editor also checks** | | ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- | | Create | Read, Update | | Update | Read | | Delete | Read, Update (Read only for Connectors, Connector Public Keys, and CA Certificates) | | Export (Tenant) | Read | | Import (Tenant) | Create, Read, Update | | Execute (Playbook/Component) | Read | | Test (Asset) | Read, Update | | Install (Connector) | Read | | Create Personal (Dashboard/Report) | Create, Read, Update | | Override Locks | Read, Update, Lock | | Restrict / Lock / Workflow History / Bypass Restrictions / Moderate Comments / Run Details | Read (plus Update for most) | | Assign / Assign Roles | Read, Update | | Update Membership (Group) | Read | | Manage External (User) | Create, Read, Update, Delete | :::hint{type="info"} Auto-check runs only when you select an access right. Deselecting one right does not auto-deselect rights that were checked with it. What you save on the role is exactly what applies; there is no hidden logic that re-adds required access later. ::: Cross-resource dependencies are **not** auto-checked. For example, viewing a dashboard may also need Read on the reports it contains, and records need at least Read on the associated application. See [Cross-Resource Dependencies](https://docs.swimlane.com/enhanced-rbac-permission-reference#cross-resource-dependencies). :::hint{type="info"} Before you replace a role on working users, **Copy Role** and test with a non-production user. Confirm every required action end to end, then assign the role broadly. ::: ### Access Prerequisites Before account and tenant permissions take effect: - The user must be associated with the account or invited as an external user. - The user must have a role (directly or through a group) that grants the needed permissions, including **Tenants → Read** to use resources inside a tenant. Without both, the user cannot reach account resources and may be unable to log in. ## Access Rights Glossary These meanings are the same wherever the access right appears. Resource-specific notes appear in the account and tenant sections below. | **Access right** | **What it lets the user do** | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Create** | Create new instances of the resource. | | **Read** | View or list the resource. Almost every other action requires Read. | | **Update** | Modify an existing resource. | | **Delete** | Remove the resource. | | **Export** | (Tenant only, on **Tenants**) Export tenant content such as applications, applets, and playbooks. | | **Import** | (Tenant only, on **Tenants**) Import content into a tenant. | | **Execute** | Run the resource. For **Playbooks & Components**, run the playbook. | | **Test** | (Assets) Run a connection or validation check. Selecting it also checks Read and Update. | | **Install** | (Connectors) Install a connector. Replaces Create for connectors. | | **Restrict** | (Records) Restrict a record so only selected users or groups can see it. | | **Lock** | (Records) Lock a record to prevent concurrent edits. | | **Override Locks** | (Records) Edit or unlock a record locked by another user. | | **Workflow History** | (Records) View workflow run history for a record. | | **Bypass Restrictions** | (Records, Dashboards, Reports) Act on a resource that is restricted to other users or groups, including restricted fields on application records. The user still needs Read (and Update to edit). | | **Moderate Comments** | (Records) Edit or delete comments left by other users. | | **Run Details** | (Playbooks & Components) View the detailed run log. | | **Create Personal** | (Dashboards, Reports) Create personal items visible only to the creator or users with Bypass Restrictions. | | **Assign** | (Roles) Assign a user or group to a role. | | **Assign Roles** | (Users, Groups) Assign a role to a user or group. | | **Update Membership** | (Groups) Change group members or group hierarchy. | | **Manage External** | (Users) Manage external (shared-account) users. | | **Bulk Update Assets** / **Bulk Delete Assets** | (Configuration Manager) Update or delete configuration assets in bulk. | ## Account-Level Permissions Account-level permissions control administrative resources across the whole account. ### Admin Panel | **Access** | **Purpose** | | ---------- | ----------------------------------------------------- | | Read | Shows the **Admin Panel** menu and opens admin pages. | :::hint{type="info"} **Admin Panel → Read** is a gate, not a master key. Each admin page also needs permissions for that page's resource. For example, the Users page needs **Admin Panel → Read** plus **Users → Read**. ::: ### Account Settings | **Access** | **Purpose** | | ---------- | ----------------------------------------------------------------------------------------------------------------------- | | Read | View account settings under **Admin Panel → Settings → Account**. | | Update | Change account settings (General, Security & Compliance, Directory Services, SSO/SAML, mail, license, Git integration). | ### Account Audit Logs | **Access** | **Purpose** | | ---------- | ----------------------------------------------------------------------------------------------------- | | Read | Retrieve account audit log entries programmatically. There is no audit-log screen in the Admin Panel. | ### Usage | **Access** | **Purpose** | | ---------- | ------------------------------------------------------------------------------------------------- | | Read | View usage reporting in the Admin Panel. Separate from tenant application reports and dashboards. | Some Usage dashboards need an extra permission: | **Dashboard** | **Also required** | | ---------------------------------------------------- | ----------------------------------------------------- | | Hero AI (Credits, Prompts, Tokens) and Notifications | Usage → Read only | | Playbook Runs and Actions | **Playbooks & Components → Run Details** (any tenant) | | Events | **Events → Read** (any tenant) | Without the extra permission, that dashboard stays hidden even if Usage → Read is granted. ### Tenants | **Access** | **Purpose** | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | Create, Read, Update, Delete | Manage tenants. **Read** is required to enter a tenant and reach its resources. | | Export | Export tenant content. Also needs **Read** on each resource type included in the package. Unreadable items are omitted. | | Import | Import tenant content. Also needs **Create** (new items) or **Update** (overwrite) on each resource type written. | ### Users | **Access** | **Purpose** | | ---------------------- | --------------------------------------------------------------------------------------- | | Read | View users in lists and pickers. Every user has implicit Read on their own user record. | | Create, Update, Delete | Create, change, or remove users. | | Assign Roles | Attach a role to a user. | | Manage External | Manage external or shared users (also checks Create, Read, Update, Delete). | Read, Update, Delete, and Assign Roles can be granted on specific users (resource-level) for MSSP or multi-customer separation. Create is account-wide only. ### Roles | **Access** | **Purpose** | | ---------------------- | ---------------------------------------- | | Read | See and select roles where roles appear. | | Create, Update, Delete | Create, change, or remove roles. | | Assign | Grant a role to a user or group. | Read, Update, Delete, and Assign can be scoped to specific roles. **Inline permissions on other resources.** Dashboards, Reports, Workspaces, Applications, and Applets expose a **Permissions** tab on their own screens: | **Task** | **Required permissions** | | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Open the Permissions tab (dashboards, reports, workspaces) | **Roles → Read**, or **Create Personal** alone when configuring a personal dashboard or report | | Add or change a role in the picker | **Roles → Update** on each role listed | | Save access on the resource | **Update** on that resource (for example, Reports → Update) | Full role editing remains under **Admin Panel → Roles**. ### Groups | **Access** | **Purpose** | | ---------------------- | ----------------------------------------- | | Read | See and select groups across the product. | | Create, Update, Delete | Create, change, or remove groups. | | Update Membership | Change group members and hierarchy. | | Assign Roles | Add a role to the group. | Read, Update, Delete, and Assign Roles can be scoped to specific groups. ### Configuration Manager | **Access** | **Purpose** | | --------------------------------------- | ------------------------------------------- | | Read | Open Configuration Manager. | | Bulk Update Assets / Bulk Delete Assets | Apply bulk changes to configuration assets. | Visible only when Configuration Manager is enabled for the account. A user with Configuration Manager → Read but without Admin Panel → Read gets a separate **Configuration Manager** entry under the user avatar. ### Content (Library) | **Access** | **Purpose** | | ---------------------------- | ---------------------------- | | Create, Read, Update, Delete | Access the **Library** menu. | Library access is account-level only. Content cannot be restricted per tenant even when associated with a tenant. ## Tenant-Level Permissions Tenant-level permissions control operational resources. Configure them per tenant, or for all tenants. Global tenant permissions can be copied from one tenant to others. Resource-level selections cannot be copied across tenants and cannot be used with **All tenants**. ### Applications | **Access** | **Purpose** | | ---------------------------- | ----------------------------------------------------------------------------------------------------------- | | Create, Read, Update, Delete | Manage applications. **Read** is required for records, dashboards, and reports related to that application. | **Inline access:** Application settings → **Administration** configures per-role application access. The tab requires **Application Records → Update**. Changing role access also requires **Roles → Update** on each affected role. ### Applets | **Access** | **Purpose** | | ---------------------------- | --------------- | | Create, Read, Update, Delete | Manage applets. | **Inline access:** Applet **Permissions** tab requires **Applets → Update** plus **Roles → Update** on each affected role. ### Application Records | **Access** | **Purpose** | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Create, Read, Update, Delete | Manage records. | | Restrict | Limit a record to selected users or groups. | | Lock / Override Locks | Lock a record; override another user's lock (Override Locks also checks Lock). | | Workflow History | View a record's workflow run history. | | Bypass Restrictions | Open, edit, and delete records and fields that are otherwise restricted. Still needs Record → Read and Update for those actions. Can be global or per application. | | Moderate Comments | Edit other users' comments on a record. | **Depends on:** Application → Read, and Playbook → Read plus Execute for playbook buttons on a record. **Inline access:** Application settings → **Records** requires **Application Records → Update** plus **Roles → Update** on each affected role. **Field-level permissions** (application builder → field Properties → Permissions) override application-level record permissions for that field. Only Read and Update can be granted per role. | **Field-permission task** | **Required** | | ----------------------------- | --------------------------------------------------------- | | Open app builder and save | **Applications → Update** on the application | | Load roles in the picker | **Account → Read** and **Roles → Read** | | Save field permission changes | **Roles → Update** on each role whose permissions changed | ### Dashboards | **Access** | **Purpose** | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------- | | Create, Read, Update, Delete | Manage shared dashboards. | | Create Personal | Create dashboards visible only to the creator (also checks Create, Read, Update). | | Bypass Restrictions | View, edit, and delete dashboards the user is not on the access list for, including personal dashboards. Global only. | **Depends on:** Read on the applications, reports, and records the dashboard uses. **Inline access:** Permissions tab opens with **Dashboards → Create Personal** or **Roles → Read**. Changing role access requires **Roles → Update**. ### Reports | **Access** | **Purpose** | | ---------------------------- | ----------------------------- | | Create, Read, Update, Delete | Manage shared reports. | | Create Personal | Same semantics as dashboards. | | Bypass Restrictions | Same semantics as dashboards. | **Depends on:** applications and records the report draws from. **Inline access:** Shared reports need **Roles → Read** and **Reports → Update**. Personal reports can open the tab with **Create Personal** alone. Changing role access requires **Roles → Update**. ### Workspaces | **Access** | **Purpose** | | ---------------------------- | ------------------ | | Create, Read, Update, Delete | Manage workspaces. | **Depends on:** applications, dashboards, and records in the workspace. **Inline access:** Requires **Roles → Read** and **Workspaces → Update**. Changing role access requires **Roles → Update**. ### Home Page | **Access** | **Purpose** | | ---------- | -------------------------------------------------------------------- | | Read | View other users' home pages (with **Users → Read** for that owner). | | Update | Edit other users' home pages (with **Users → Read** for that owner). | Every user can view and configure their own home page without Home Page permission. Read and Update are account-wide only (not per-instance) and apply to other users' home pages and bulk home-page actions. ### Playbooks & Components | **Access** | **Purpose** | | ---------------------------- | ----------------------------------------------- | | Create, Read, Update, Delete | Author and manage playbooks and components. | | Execute | Run a playbook or component (also checks Read). | | Run Details | Open the detailed run log. | Read plus Execute are required to use playbook buttons on records. ### Connectors | **Access** | **Purpose** | | ------------ | -------------------------------------------------------- | | Install | Install a connector (also checks Read). Replaces Create. | | Read, Delete | View and remove connectors. No Create or Update. | ### Connector Public Keys | **Access** | **Purpose** | | --------------- | ------------------------------------------------------------------ | | Read | Show **Connector Trust Keys** under Tenant Settings and list keys. | | Create / Delete | Add or remove a key. | Also needs **Admin Panel → Read** and **Tenant Settings → Read** to reach the UI. ### Assets | **Access** | **Purpose** | | ---------------------------- | ------------------------------------------------------------------- | | Create, Read, Update, Delete | Manage assets used in playbooks and applications. | | Test | Run a connection or validation check (also checks Read and Update). | ### Webhooks | **Access** | **Purpose** | | ---------------------------- | -------------------------------------------------- | | Create, Read, Update, Delete | Manage webhook triggers while authoring playbooks. | ### Events | **Access** | **Purpose** | | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Read | Show the **Events** tab in Operational Health (Operational Health must be enabled; also needs Playbook → Create, Update, or Delete). Also required for **Admin Panel → Usage → Events** with Admin Panel → Read and Usage → Read. | ### Playbook Alerts | **Access** | **Purpose** | | ---------- | ------------------------------------------------------------------------ | | Read | View playbook alerts in Operational Health when that feature is enabled. | ### Pools | **Access** | **Purpose** | | ------------------------ | --------------------------------------------------------------------------------------------------- | | Read | List pools and open a pool. | | Create / Update / Delete | Add, edit, or remove a pool. Delete also needs **Remote Agent → Update** and **Playbook → Update**. | Managed under **Admin Panel → Settings → Tenant Settings** (Nodes / Remote Agents). Needs Admin Panel → Read and Tenant Settings → Read. Selecting a pool inside a playbook action is not separately gated by Pool permission. ### Remote Agents | **Access** | **Purpose** | | ---------- | ----------------------------------------------------------------------------------------------------------- | | Read | List agents and open details. | | Update | Rename, enable or disable, and change pool assignments. | | Delete | Remove an agent. | | Create | Agents register when deployed with the install script; day-to-day management uses Read, Update, and Delete. | Same Tenant Settings page as pools. Deleting a pool needs Remote Agent → Update. Viewing a pool's linked agents needs Remote Agent → Read. ### CA Certificates | **Access** | **Purpose** | | ---------- | --------------------------------------------------------------- | | Read | Show the **CA Certificates** tab and list certificates. | | Create | Upload a PEM string or file. | | Delete | Remove a certificate. No Update — replace by delete and create. | Managed under Tenant Settings. Distribution to remote agents when an agent is enabled uses Remote Agent → Update and does not require CA Certificate permission. ### Tenant Settings | **Access** | **Purpose** | | ---------- | ------------------------------------------------------------------------------------ | | Read | Open Tenant Settings and see tenants in the selector. Also needs **Tenants → Read**. | | Update | Save tenant settings. | | **Tab** | **Additional gate** | | -------------------------------- | --------------------------------------------------------------- | | System, Email & PDF | Tenant Settings Read / Update | | Connector Trust Keys | Connector Public Key → Read | | CA Certificates | CA Certificate → Read (Create/Delete for add/remove) | | Agents (Remote Agents and Pools) | Remote Agent and Pool permissions | | Features | Super admins or users allowed to manage tenant feature settings | | Orchestration Alerts | Shown when Operational Health is enabled | ### Tenant Audit Logs | **Access** | **Purpose** | | ---------- | --------------------------------------------------- | | Read | Retrieve tenant audit logs programmatically. No UI. | ## Cross-Resource Dependencies A parent resource never auto-grants its dependencies. Missing any link blocks the feature. | **Goal** | **Also required** | | ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | Read a record | Application → Read; Application Records → Read | | See users or groups in user/group fields on a record | Users → Read and/or Groups → Read (account level). Names already stored may still display; unresolved entries can render blank | | Run a playbook from a record | Playbook → Read and Execute | | Use a dashboard, report, or workspace | Read on the applications, reports, and records they surface | | Configure access on a resource's own screen | Update on that resource (or Create Personal for personal dashboards/reports); Roles → Update to change which roles have access | | Set field-level permissions in the app builder | Applications → Update; Account → Read and Roles → Read to load roles; Roles → Update to save | | Open any admin page | Admin Panel → Read plus the page's resource permission | | Export tenant content | Tenants → Export plus Read on each exported resource | | Import tenant content | Tenants → Import plus Create or Update on each imported resource | ## Troubleshoot Access Issues | **Check** | **What to verify** | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1. Role assignment | Direct role assignment and group membership. Roles assigned to a group apply to direct members only. | | 2. Target resource | The role includes the required access right on the specific resource (and tenant, if tenant-level). | | 3. Dependent resources | Related permissions from [Cross-Resource Dependencies](https://docs.swimlane.com/enhanced-rbac-permission-reference#cross-resource-dependencies). Record → Read alone does not unlock dashboards or playbook buttons. | For new or changed roles, copy the role and test with a non-production user before broad assignment. ## Next Steps - [Enhanced Role-Based Access Control (RBAC)](docId:4c4ar7pxA6dE6TJ3DZB_S) — create and edit roles in the UI - [Move from Legacy RBAC to Enhanced RBAC](https://docs.swimlane.com/move-from-legacy-rbac-to-enhanced-rbac) — migration mapping and support request - [Test Connector Assets](https://docs.swimlane.com/test-connector-assets) — **Assets → Test** permission - [Configuration Manager](https://docs.swimlane.com/configuration-manager) — bulk asset actions and permissions