Skip to content
NereusDocs

Roles & permissions

The five system roles and the permissions each carries. Roles are cumulative — each is a strict superset of the one to its left. For the model behind scoping and grants, see Projects & access.

Source of truth: packages/domain/src/identity/Rbac.ts (ROLE_PERMISSIONS).

Permission Viewer Operator Engineer Admin Owner
asset:read ✓ ✓ ✓ ✓ ✓
alert:read ✓ ✓ ✓ ✓ ✓
rule:read ✓ ✓ ✓ ✓ ✓
member:read ✓ ✓ ✓ ✓ ✓
billing:read ✓ ✓ ✓ ✓ ✓
alert:ack ✓ ✓ ✓ ✓
rule:edit ✓ ✓ ✓
asset:manage ✓ ✓ ✓
dashboard:edit ✓ ✓ ✓
report:edit ✓ ✓ ✓
billing:manage ✓ ✓ ✓
member:invite ✓ ✓
member:manage ✓ ✓
role:grant ✓ ✓
tenant:manage ✓

What each role is for

Section titled “What each role is for”
Role In one line
Viewer Read-only across assets, alerts, rules, members, and billing
Operator Viewer + acknowledge alerts — front-line triage
Engineer Operator + edit rules, manage assets, edit dashboards & reports, manage billing
Admin Engineer + invite/manage members and grant roles
Owner Admin + manage the organisation itself

Notes:

  • Viewing a report has no dedicated permission — it gates on asset:read plus project access, since a report is a lens over data you can already see. Editing or scheduling one needs report:edit (Engineer or above).
  • A grant applies at a scope (organisation, project, or group). A member’s effective permissions are the union of their grants over the resource in question — see Projects & access.
Section titled “Related”