Permissions Reference

Verdictan uses scoped permissions to control the actions of a person or token in an organization. This page shows the organization-scoped actions for the customer workflows on this site. The permission catalog for a role is authoritative for the active environment.

How permission checks work

Verdictan evaluates access with deny-by-default behavior:

1. A matching deny wins.
2. A matching allow grants access.
3. If nothing allows the action, Verdictan denies the request.

That model applies to console workflows, CLI commands that call the control plane, and organization-scoped tokens.

Public action groups

Investigations and evidence

Action	Purpose
events:read	The caller can view governance events.
events:write	The caller can create or add events.
events:export	The caller can export governance events.
escalations:read	The caller can view escalation queues.
escalations:claim	The caller can claim an escalation.
escalations:resolve	The caller can resolve an escalation.
exports:read	The caller can view export jobs and download their artifacts.
exports:write	The caller can create export jobs.
org:trail:read	The caller can view Trail events and evidence.
org:trail:admin	The caller can manage Trail workflows and evidence operations.

Configurations and gateways

Action	Purpose
configs:read	The caller can view saved configurations.
configs:write	The caller can create or update configurations.
gateways:read	The caller can view gateway status and details.
gateways:register	The caller can register a connected gateway.
gateways:rotate_token	The caller can rotate the machine token for a connected gateway.
gateways:deploy	The caller can apply gateway configuration changes.
gateways:admin	The caller can do administrative gateway mutations, such as deletion.
gateways:bind_agent	The caller can bind an agent to a gateway.
gateways:unbind_agent	The caller can remove an agent binding from a gateway.
gateways:update_policy	The caller can update a gateway policy binding.
gateways:report_status	A machine credential can report runtime health.
agents:manage_publication	The caller can manage the agent publication lifecycle.

Teams, users, and policy governance

Action	Purpose
users:read	The caller can view organization members.
users:invite	The caller can invite members.
users:manage	The caller can manage member status and organization-level access.
teams:read	The caller can view teams.
teams:manage	The caller can create, update, or delete teams.
roles:read	The caller can view roles.
roles:write	The caller can create or update roles.
roles:assign	The caller can assign roles to users or teams.
policies:read	The caller can view IAM policies.
policies:write	The caller can create or update IAM policies.
org:settings	The caller can manage organization settings.
sso:read	The caller can view active SSO connections, verified domains, and SCIM configuration.
sso:write	The caller can create or manage active SSO connections, domains, mappings, and SCIM credentials.
oauth_clients:read	The caller can view registered OAuth clients.
oauth_clients:write	The caller can register, update, or deactivate OAuth clients.
org:audit	The caller can view organization audit activity.

Tokens, spend, and notifications

Action	Purpose
tokens:list	The caller can list tokens.
tokens:create	The caller can create tokens.
tokens:read	The caller can view token details.
tokens:update	The caller can update token metadata.
tokens:rotate	The caller can rotate token credentials.
tokens:revoke	The caller can revoke tokens.
tokens:validate	The caller can validate a token through the control-plane validation endpoint.
spend:read	The caller can view spend summaries and logs.
costs:read	The caller can view usage-cost summaries and provider-cost telemetry.
cost_governance:write	The caller can manage cost-governance budgets and related controls.
budgets:read	The caller can view budgets.
budgets:create	The caller can create a budget.
budgets:update	The caller can update a budget.
budgets:delete	The caller can delete a budget.
budgets:write	The caller can create, update, or delete budget-policy records. This action does not replace the specified budget actions.
notifications:read	The caller can view notifications.
notifications:manage	The caller can manage notification channels and preferences.

Supporting product surfaces

Action	Purpose
agents:read	The caller can view agent details and supporting agent settings.
agents:write	The caller can manage access policies, usage constraints, gateway groups, and other supporting agent settings.
agents:list	The caller can list agents.
agents:create	The caller can create an agent.
agents:update	The caller can update an agent.
agents:delete	The caller can delete an eligible agent.
agents:deploy	The caller can run supported agent deployment actions.
agents:bind_gateway	The caller can add or replace agent-to-gateway links.
agents:unbind_gateway	The caller can remove an agent-to-gateway link.
agents:review	The caller can create an agent review execution.
templates:read	The caller can view templates.
models:read	The caller can view the published model catalog.
history:read	The caller can view governed history.
history:write	The caller can manage history records when the workflow allows it.
context:read	The caller can read or resolve Context Fabric data when the context endpoint uses this action.
work_receipts:read	The caller can search user-scoped work receipts.
work_receipts:write	The caller can create user-scoped work receipts.
secrets:list	The caller can list secret records when a workflow uses this action.
secrets:read	The caller can view secret metadata and simulate provider-key access.
secrets:write	The caller can create, rotate, update, or delete secrets.
cache:read	The caller can view Context Fabric artifacts, materialization state, and related cache-governance data.
cache:admin	The caller can manage repository-source trust, artifact lifecycle actions, and related cache-governance controls.

Role structure

A usual organization setup assigns these responsibilities to different roles:

• Reviewers and analysts must have investigation and export permissions.
• Configuration owners must have config and gateway rollout permissions.
• Identity administrators must have invite, team, role, and SSO permissions.
• Finance or governance owners must have spend and budget visibility.
• Give machine credentials fewer permissions than human admin roles.

Token guidance

Use different credentials for different jobs:

• Use request-execution tokens for applications that send governed traffic.
• Use runtime tokens for gateways that report state or connect to managed workflows.
• Use human user roles for console and CLI operations that must have broader review or rollout access.

Next steps

• Read Identity and Access.
• Read Roles and IAM Policies.
• Read Onboarding Flows.
• Read API Key Management.
• Read Configurations.