Permissions
Permissions in Plakar Control Plane are scoped to an organization. A user who belongs to several organizations holds a separate set of permissions in each one, and nothing granted in one organization carries over to another. See Managing Users for how membership works.
A user who has just been added to an organization has no permissions at all. They can sign in, but they cannot reach any resource or perform any operation until permissions are granted to them.
Permission families
Permissions are grouped into three families, based on what the access reaches.
Organization
Applies across the whole organization rather than to any individual resource. It covers the organization itself and the administrative records attached to it:
- Organization
- Members
- Audit log
- Data residency
- Restore points legal holds
- Inventory resources legal holds
Resources
Applies to the resources that belong to the organization. Access is expressed per resource class:
- Inventories
- Apps
- Restore point data
- Secret Providers
- Integrations
- Policies
- Settings
- Edges
- Configuration bundles
- Data classes
- Environments
- Schedules
Deployment
Applies to the instance itself, which belongs to no organization. Access granted here reaches every organization hosted on the instance, not only the one the permission was granted in:
- Control plane
- License
Access levels
Every resource in a family is held at one of five levels:
- No access, the permission cannot be reached at all.
- View, it can be read but not changed.
- Run, it can be read and the work it defines can be started, but it cannot be changed.
- Configure, it can be read and changed, but not deleted, and who else can reach it cannot be changed either.
- Full, everything above, including deleting and granting access to it.
Roles
Access is granted by assigning a role. A role is a preset set of capabilities, and the accesses it grants are always a combination of capabilities described in the three families.
Roles are offered in two sets. Standard holds the four that cover most cases: Owner, Administrator, Operator, and Auditor. Advanced holds every other role, each of which narrows access to one area of the system, such as policies, secret providers, or edges, or is meant for a non-human identity. Switching to the advanced set is what makes those available to grant.
Full access to every organization and to the instance itself.
Maintains the instance itself, and administers no organization.
Full control over one organization, and nothing on the deployment.
Everything inside an organization, except the organization settings themselves.
Administers one organization, and cannot see or act outside it.
Runs and defines the backup chain, without administering the organization.
Non-human identity for CI/CD and orchestrators, which runs what is already defined.
Runs and supervises backup jobs, and defines none of them.
Owns the shared backup vocabulary, and runs no backup.
Places and releases legal holds, and reads the state they apply to.
Decides where the data of an organization is allowed to live.
Owns the secret providers an organization’s credentials come from.
Manages the machines an organization runs its work on.
Reads everything in an organization and changes nothing.
Non-human identity that reads metrics and exports logs.
Reads how backups are configured and what has run, and nothing else.
Manages the KMS or HSM integration behind secret providers. Coming soon.
Approves critical restores and chooses the authorised target. Coming soon.
Triggers restores onto authorised targets within its perimeter. Coming soon.
Exports and imports backup data during a migration. Coming soon.