Superuser
The Superuser is the admin account created during enrollment.
It holds full access to every permission in all three families. Its resource access is not restricted to a subset, it covers every resource of every class in the organization.
The Superuser reaches the deployment family, which is what allows it to change Control Plane settings and manage the license. Because the instance belongs to no organization, that access extends to every organization hosted on it.
The Platform Admin holds that same deployment access and nothing else. It maintains the instance and administers no organization, which is what separates it from the Superuser.
Organization
| Permission | Access |
|---|---|
| Organization | Full |
| Members | Full |
| Audit log | Full |
| Data residency | Full |
| Restore points legal holds | Full |
| Inventory resources legal holds | Full |
Resources
| Permission | Access |
|---|---|
| Inventories | Full |
| Apps | Full |
| Restore point data | Full |
| Secret Providers | Full |
| Integrations | Full |
| Policies | Full |
| Settings | Full |
| Edges | Full |
| Configuration bundles | Full |
| Data classes | Full |
| Environments | Full |
| Schedules | Full |
Deployment
| Permission | Access |
|---|---|
| Control plane | Full |
| License | Full |