Skip to content

Commit d996fb3

Browse files
olagruchalaclaude
olagruchala
and
claude
committed
docs: add Console viewer role to roles and permissions
Document the read-only Viewer role for workspaces and projects: what it can read, that resource-changing actions are disabled, and that runtime data — identities, sessions, message delivery, OAuth2 clients, permission relationships, and issued and imported API keys — is hidden. Update both permission matrices, and note that project roles are additive so a member can hold a higher role on a specific project than their workspace role. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 1f13ed7 commit d996fb3

1 file changed

Lines changed: 77 additions & 31 deletions

File tree

‎docs/console/roles-and-permissions.mdx‎

Lines changed: 77 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ The Ory Console uses role-based access control enforced through Ory Keto. Roles
88

99
## Workspace roles
1010

11-
A workspace has two roles: Owner and Developer.
11+
A workspace has three roles: Owner, Developer, and Viewer.
1212

1313
### Owner
1414

@@ -37,25 +37,43 @@ Developers cannot:
3737
- Manage workspace members
3838
- Create or delete workspace API keys
3939

40+
### Viewer
41+
42+
The Viewer role provides read-only access to the workspace.
43+
44+
- View workspace metadata
45+
- View members
46+
- View workspace API keys
47+
- View the projects list
48+
49+
Viewers also get read-only access to the settings of every project in the workspace. See [project Viewer](#viewer-1) for what that
50+
includes.
51+
52+
Viewers cannot:
53+
54+
- Create projects
55+
- View or manage billing
56+
- Change any workspace setting
57+
4058
### Workspace permission matrix
4159

42-
| Permission | Developer | Owner |
43-
| -------------------------------- | --------- | ----- |
44-
| View workspace metadata | Yes | Yes |
45-
| Edit workspace metadata | No | Yes |
46-
| Upgrade workspace plan | No | Yes |
47-
| View billing | No | Yes |
48-
| Manage billing | No | Yes |
49-
| View members | Yes | Yes |
50-
| Manage members | No | Yes |
51-
| View workspace API keys | Yes | Yes |
52-
| Create/delete workspace API keys | No | Yes |
53-
| Create projects | Yes | Yes |
54-
| View projects list | Yes | Yes |
60+
| Permission | Viewer | Developer | Owner |
61+
| -------------------------------- | ------ | --------- | ----- |
62+
| View workspace metadata | Yes | Yes | Yes |
63+
| Edit workspace metadata | No | No | Yes |
64+
| Upgrade workspace plan | No | No | Yes |
65+
| View billing | No | No | Yes |
66+
| Manage billing | No | No | Yes |
67+
| View members | Yes | Yes | Yes |
68+
| Manage members | No | No | Yes |
69+
| View workspace API keys | Yes | Yes | Yes |
70+
| Create/delete workspace API keys | No | No | Yes |
71+
| Create projects | No | Yes | Yes |
72+
| View projects list | Yes | Yes | Yes |
5573

5674
## Project roles
5775

58-
A project has two roles: Owner and Developer.
76+
A project has three roles: Owner, Developer, and Viewer.
5977

6078
### Owner
6179

@@ -89,29 +107,57 @@ Developers cannot:
89107
- Add or remove collaborators
90108
- Modify project workspace settings
91109

110+
### Viewer
111+
112+
The Viewer role provides read-only access to project settings.
113+
114+
- Read project configuration
115+
- View collaborators
116+
- View project API keys
117+
- View custom domains (CNAMEs)
118+
- View event streams
119+
120+
Viewers have no access to data managed by Ory services. They cannot read or write identities, sessions, message delivery, OAuth2
121+
clients, permission relationships, or issued and imported API keys.
122+
123+
In the Ory Console, the actions that would change a resource — such as save, create, delete, and invite — are disabled for
124+
Viewers, with a tooltip explaining the missing permission.
125+
92126
### Project permission matrix
93127

94-
| Permission | Owner | Developer |
95-
| --------------------------------- | ----- | --------- |
96-
| Read project configuration | Yes | Yes |
97-
| Write project configuration | Yes | Yes |
98-
| View collaborators | Yes | Yes |
99-
| Add/remove collaborators | Yes | No |
100-
| Manage project API keys | Yes | Yes |
101-
| Manage custom domains (CNAMEs) | Yes | Yes |
102-
| Manage event streams | Yes | Yes |
103-
| Ory Identities (full read/write) | Yes | Yes |
104-
| Ory Permissions (full read/write) | Yes | Yes |
105-
| Ory OAuth2 (full read/write) | Yes | Yes |
106-
| Delete project | Yes | No |
107-
| Move project | Yes | No |
108-
| Upgrade project plan | Yes | No |
109-
| Modify workspace settings | Yes | No |
128+
| Permission | Viewer | Developer | Owner |
129+
| ----------------------------------- | ------ | --------- | ----- |
130+
| Read project configuration | Yes | Yes | Yes |
131+
| Write project configuration | No | Yes | Yes |
132+
| View collaborators | Yes | Yes | Yes |
133+
| Add/remove collaborators | No | No | Yes |
134+
| View project API keys | Yes | Yes | Yes |
135+
| Manage project API keys | No | Yes | Yes |
136+
| View issued and imported API keys | No | Yes | Yes |
137+
| Manage issued and imported API keys | No | Yes | Yes |
138+
| View custom domains (CNAMEs) | Yes | Yes | Yes |
139+
| Manage custom domains (CNAMEs) | No | Yes | Yes |
140+
| View event streams | Yes | Yes | Yes |
141+
| Manage event streams | No | Yes | Yes |
142+
| Ory Identities (full read/write) | No | Yes | Yes |
143+
| Ory Permissions (full read/write) | No | Yes | Yes |
144+
| Ory OAuth2 (full read/write) | No | Yes | Yes |
145+
| Delete project | No | No | Yes |
146+
| Move project | No | No | Yes |
147+
| Upgrade project plan | No | No | Yes |
148+
| Modify workspace settings | No | No | Yes |
110149

111150
## Managing roles
112151

113152
To change a member's role, a workspace Owner can go to <ConsoleLink route="workspace.settings.members" />.
114153

154+
When inviting a member to a workspace or a collaborator to a project, you select the role as part of the invitation.
155+
156+
Project roles are additive to workspace roles. A member's effective role on a project is the higher of their workspace role and
157+
any role they hold directly on that project. To raise a workspace Viewer to Developer on a single project, invite that member to
158+
the project with the Developer role — the role is chosen in the invitation and can't be changed afterwards. They then have
159+
Developer access on that project while staying read-only across the rest of the workspace.
160+
115161
![Workspace members](./_static/workspace-settings-members-page.png)
116162

117163
For more information on workspaces and member management, see [Workspaces & Environments](../guides/workspaces.mdx).

0 commit comments

Comments
 (0)