Permission Catalogue
All 27 page permissions and all 69 action permissions, with what each governs.
Access is enforced in two independent server-side layers. See Access Control for how they compose.
Page permissions (27)
Each governs access to a module or family of modules, controlling both navigation and the underlying API routes.
| Permission | Category | Governs |
|---|---|---|
command_center | Core | Apex and all eleven of its screens |
overview | Spend & Optimization | Overview, Optimization, CEO View, AI Infrastructure, AI Provider Accounts |
aws_accounts | Core | Cloud Accounts across all four providers |
cloud_inventory | Security & Risk | Inventory and FinSecOps |
integrations | Core | Integrations and Kubernetes |
pr_cost_diff | Controls & Governance | PR Cost Review |
approvals | Controls & Governance | Approvals |
findings | Spend & Optimization | Opportunity Queue and Compliance |
policies | Controls & Governance | Policies |
intelligence | Spend & Optimization | Intelligence, Reports, Cost Center, Database Health, API Monitoring, Predictive Analytics, Cloud Playground, Deploy & Migration, CI/CD Control Tower |
audit_logs | Controls & Governance | Audit Logs |
support | Help & Updates | Support and Errors |
settings | Workspace & Access | Settings |
organization | Workspace & Access | Organization, Workspace Setup, Org Analytics |
membership | Workspace & Access | Membership and Apex AI Credits |
cloud_billing | Spend & Optimization | Cloud Billing |
identity | Workspace & Access | Identity & SSO |
waste_schedules | Controls & Governance | Waste scheduling |
tag_policies | Controls & Governance | Tag Governance |
spend_allocation | Controls & Governance | Cost Allocation |
finops_maturity | Spend & Optimization | FinOps Maturity |
vendors | Spend & Optimization | Vendor Hub and its sub-modules |
resource_parking | Controls & Governance | Resource Parking |
unit_economics | Spend & Optimization | Unit Economics |
ownership | Controls & Governance | Ownership |
autopilot | Spend & Optimization | Autopilot |
ai_cost | Spend & Optimization | AI cost surfaces |
Note the breadth of `intelligence`
A single permission governs nine modules. Granting it is a larger decision than it looks — review what it opens before assigning it broadly.
Action permissions (69)
Each governs a specific operation. A user may hold a page permission without holding the action permissions for operations on that page.
| Domain | Actions |
|---|---|
| Cloud accounts | aws_accounts.create, .delete, .verify_connection, .write_access_verify — and the identical four for azure_accounts, gcp_accounts, and oci_accounts (16 total) |
| AWS Organizations | aws_organizations.create, aws_organizations.assign_account |
| Inventory | inventory.scan |
| Integrations | integrations.manage, .create_ticket, .run_alerts, .ingest_kubernetes, .execute_remediation |
| Infrastructure as code | iac.analyze |
| Spend | spend.ingest_demo, spend.ingest_ce |
| Findings | findings.update_status |
| Policies | policies.create, .update, .delete |
| Budgets | budgets.upsert |
| Approvals | approvals.decide |
| Workspaces | workspaces.create |
| Authentication | auth.update_profile, auth.delete_account |
| Organization | organization.manage_users |
| Intelligence | intelligence.ingest_telemetry, .waste_scan, .negotiate_commitments |
| Release intelligence | release_intelligence.request_action |
| Cloud changes | cloud_changes.apply |
| Autopilot | autopilot.config.manage, .rules.manage, .evaluate.run, .actions.review |
| Ownership | ownership.teams.manage, .services.manage, .assignments.manage, .rules.manage, .sweep.run |
| Membership | membership.manage |
| Cloud billing | cloud_billing.dispute |
| SSO | sso.configure |
| Waste schedules | waste_schedules.create, .update, .delete, .execute |
| Tag policies | tag_policies.create, .update, .delete |
| Spend allocation | spend_allocation.create, .update, .delete |
| Vendors | vendors.create, .update, .archive, .manage_catalogs |
| Database health | db_health.alert_rules.manage |
The permissions to guard most carefully
These reach your cloud infrastructure or your money
Reserve these for the small number of people accountable for changes to the estate:
| Permission | Why it matters |
|---|---|
approvals.decide | Approves every gated change in the platform |
integrations.execute_remediation | Executes changes against your cloud |
autopilot.* | Governs autonomous action |
cloud_changes.apply | Applies changes to live cloud state |
intelligence.negotiate_commitments | Commits real money to Savings Plans |
*_accounts.write_access_verify | Grants the platform execution capability |
membership.manage | Changes the commercial relationship |
sso.configure | Changes how everyone authenticates |