Access catalog

This reference summarizes the stable authorization vocabulary. The role editor in the authenticated application remains the source of truth for the permissions and assignable scopes available in the running version.

Authorization resources

Type ID prefix Parent Contains or represents

Type	ID prefix	Parent	Contains or represents
Organization	`ORG-`	Root	Workspaces, teams, organization roles, and access administration.
Team	`TEM-`	Organization	A principal group whose members receive team grants.
Workspace	`WSP-`	Organization	Projects, configuration groups, agents, and deployment targets.
Project	`PRO-`	Workspace	Pipelines and optional Repository and Registry resources.
Pipeline	`PIP-`	Project	An executable action graph and its runs.
Run	`RUN-`	Pipeline	One execution, including logs and test reports.
Repository	`GIT-`	Project	Hosted Git source and protocol access.
Registry	`REG-`	Project	OCI inventory, pull, push, visibility, and access tokens.
Variable group	`VGR-`	Workspace	Reusable non-sensitive execution context.
Secret group	`SGR-`	Workspace	Reusable sensitive execution context.
DinaSync agent	`DSA-`	Workspace	An enrolled customer-environment agent.
Deployment target	`TAR-`	Workspace	A centrally configured deployment destination and strategy.

Organization

ORG-

Root

Workspaces, teams, organization roles, and access administration.

Team

TEM-

Organization

A principal group whose members receive team grants.

Workspace

WSP-

Organization

Projects, configuration groups, agents, and deployment targets.

Project

PRO-

Workspace

Pipelines and optional Repository and Registry resources.

Pipeline

PIP-

Project

An executable action graph and its runs.

Run

RUN-

Pipeline

One execution, including logs and test reports.

Repository

GIT-

Project

Hosted Git source and protocol access.

Registry

REG-

Project

OCI inventory, pull, push, visibility, and access tokens.

Variable group

VGR-

Workspace

Reusable non-sensitive execution context.

Secret group

SGR-

Workspace

Reusable sensitive execution context.

DinaSync agent

DSA-

Workspace

An enrolled customer-environment agent.

Deployment target

TAR-

Workspace

A centrally configured deployment destination and strategy.

Permission families

Family	Operations
Role and grant	View, create, update, or remove role definitions; inspect or manage scoped grants.
Organization and team	View and update organization metadata; manage organization or team membership; create and manage teams.
Workspace and project	Create, view, update, or delete workspace and project resources; inspect membership and cost capabilities where available.
Pipeline and run	Create and edit pipelines, execute them, assign context groups, inspect runs, read logs and reports, or cancel work.
Repository	Enable hosting, inspect metadata, browse files, read through Git, write through Git, or manage the repository lifecycle.
Registry	Enable the Registry, inspect inventory, pull, push, manage configuration, and manage access tokens.
Variable and secret groups	Create, view metadata, use from pipelines, update, or delete groups. Secret permissions never make saved secret values readable.
DinaSync and deployment targets	Enroll, inspect, assign, or revoke agents; create, inspect, update, enable, disable, deploy to, or delete targets.

Family

Operations

Role and grant

View, create, update, or remove role definitions; inspect or manage scoped grants.

Organization and team

View and update organization metadata; manage organization or team membership; create and manage teams.

Workspace and project

Create, view, update, or delete workspace and project resources; inspect membership and cost capabilities where available.

Pipeline and run

Create and edit pipelines, execute them, assign context groups, inspect runs, read logs and reports, or cancel work.

Repository

Enable hosting, inspect metadata, browse files, read through Git, write through Git, or manage the repository lifecycle.

Registry

Enable the Registry, inspect inventory, pull, push, manage configuration, and manage access tokens.

Variable and secret groups

Create, view metadata, use from pipelines, update, or delete groups. Secret permissions never make saved secret values readable.

DinaSync and deployment targets

Enroll, inspect, assign, or revoke agents; create, inspect, update, enable, disable, deploy to, or delete targets.

Built-in system roles

Organization

Role	Responsibility
Organization Owner	Full organization ownership and access administration.
Organization Administrator	Organization administration without organization deletion.
Organization Member	Organization identity and general information.
Team Manager	Team metadata and membership administration.

Role

Responsibility

Organization Owner

Full organization ownership and access administration.

Organization Administrator

Organization administration without organization deletion.

Organization Member

Organization identity and general information.

Team Manager

Team metadata and membership administration.

Workspace and project

Role	Responsibility
Workspace Administrator	Full administration of a workspace subtree.
Workspace Access Administrator	Grant administration for a workspace subtree.
Workspace Viewer	Read-only workspace and descendant access.
Workspace Member	Standard build and delivery capabilities inside a workspace.
Project Administrator	Full project, pipeline, source, and Registry administration.
Project Developer	Project pipeline development and execution.
Project Viewer	Project overview without descendant content.
Project Full Viewer	Read-only project, pipeline, source, and Registry access.

Role

Responsibility

Workspace Administrator

Full administration of a workspace subtree.

Workspace Access Administrator

Grant administration for a workspace subtree.

Workspace Viewer

Read-only workspace and descendant access.

Workspace Member

Standard build and delivery capabilities inside a workspace.

Project Administrator

Full project, pipeline, source, and Registry administration.

Project Developer

Project pipeline development and execution.

Project Viewer

Project overview without descendant content.

Project Full Viewer

Read-only project, pipeline, source, and Registry access.

Pipeline and run

Role	Responsibility
Pipeline Editor	Pipeline definition editing and context-group assignment.
Pipeline Operator	Pipeline execution and run operation.
Pipeline Viewer	Read-only pipeline and run access.
Run Viewer	Read-only run, log, and test-report access.

Role

Responsibility

Pipeline Editor

Pipeline definition editing and context-group assignment.

Pipeline Operator

Pipeline execution and run operation.

Pipeline Viewer

Read-only pipeline and run access.

Run Viewer

Read-only run, log, and test-report access.

Source and Registry

Role	Responsibility
Repository Reader	Repository browsing, clone, and fetch.
Repository Contributor	Repository read and push access.
Repository Manager	Repository lifecycle and full Git protocol access.
Registry Consumer	Registry inventory and pull access.
Registry Publisher	Registry pull and push access.
Registry Manager	Registry lifecycle, token, and protocol administration.

Role

Responsibility

Repository Reader

Repository browsing, clone, and fetch.

Repository Contributor

Repository read and push access.

Repository Manager

Repository lifecycle and full Git protocol access.

Registry Consumer

Registry inventory and pull access.

Registry Publisher

Registry pull and push access.

Registry Manager

Registry lifecycle, token, and protocol administration.

Configuration and deployment

Role	Responsibility
Variable Group Consumer / Manager	Use a variable group, or manage and use it.
Secret Group Consumer / Manager	Use a secret group, or manage and use it, without retrieving stored values.
DinaSync Agent Manager	Enroll, assign, and revoke DinaSync agents.
Deployment Target Operator	View targets and start deployments.
Deployment Target Manager	Full deployment-target administration.

Role

Responsibility

Variable Group Consumer / Manager

Use a variable group, or manage and use it.

Secret Group Consumer / Manager

Use a secret group, or manage and use it, without retrieving stored values.

DinaSync Agent Manager

Enroll, assign, and revoke DinaSync agents.

Deployment Target Operator

View targets and start deployments.

Deployment Target Manager

Full deployment-target administration.

Custom roles use the same permission catalog. Their canonical identifiers begin with ROL-; assignments begin with GRA-.

See How access control works for inheritance and implications.