Roles and capabilities
The tables are generated from the authorization policy in the application, so a capability that appears here is exactly what the server checks.
Workspace roles
Section titled “Workspace roles”| Capability | Member | Administrator | Owner |
|---|---|---|---|
workspace.read | ✓ | ✓ | ✓ |
workspace.members.manage | ✓ | ✓ | |
workspace.settings.manage | ✓ | ✓ | |
workspace.services.create | ✓ | ✓ | |
workspace.ownership.manage | ✓ | ||
deployment.plan.approve | ✓ | ✓ | |
deployment.rollback.approve | ✓ | ✓ |
Administrators and Owners additionally hold the platform capabilities platform.access.manage,
platform.service.create, and workspace.audit.read, which gate the AI, Deployments,
Activity, and Settings areas.
Service roles
Section titled “Service roles”| Capability | Console label | Requester | Developer | Administrator |
|---|---|---|---|---|
service.read | View service | ✓ | ✓ | ✓ |
change.request.create | Request changes | ✓ | ✓ | |
change.request.clarify | Clarify change requests | ✓ | ✓ | |
change.criteria.confirm | Confirm success criteria | ✓ | ✓ | |
service.administer | Delegated service responsibility | ✓ | ||
implementation.plan.approve | Approve implementation plans | ✓ | ||
implementation.run.start | Start approved implementations | ✓ | ||
implementation.run.cancel | Cancel implementations | ✓ |
Roles union when a person holds several on one service. Confirming criteria additionally requires
being the original requester. Viewing model- or repository-derived text on a change requires
implementation.plan.approve. The console labels are the ones shown on a service’s Your
access card.
AI capabilities on a service policy
Section titled “AI capabilities on a service policy”| Capability | Console label | Required for |
|---|---|---|
repository:read |
Read repository context | Planning and implementation |
service:ask |
Answer service questions | Contextual assistance |
change:plan |
Plan changes | Planning; requires repository:read |
change:implement |
Implement changes | Implementation; requires repository:read |
branch:create |
Create branches | Pull-request delivery |
pull_request:create |
Open pull requests | Pull-request delivery; requires branch:create |
A source’s detected capabilities (repository:read, repository:write, branch:create,
pull_request:create) are the ceiling for what a service enrolled from it can enable.
Support grant scopes
Section titled “Support grant scopes”workspace.audit.read (console label Read audit) and workspace.admin (Workspace
administration).
Runner isolation labels
Section titled “Runner isolation labels”Every AI runner carries domain:code, network:none, and runtime:isolated; they cannot be
removed at registration.