Skip to content
AletheiaAletheiaAletheia docs

Roles and permissions

Every member of your organization holds one or more roles. A role grants a set of permissions, and permissions are what the API checks.

The system roles

Section titled “The system roles”

Ten roles are seeded into every organization.

Role Grants
Viewer Read-only access to resources and reports
Developer Viewer, plus proposing changes
Infrastructure Operator Developer, plus running plans, managing drift, triggering workflows, and reading integrations
Reviewer Viewer, plus approving proposed changes
Application Owner Developer, plus managing applications and approving changes
Platform Administrator Full administrative control over the organization
Security Reviewer Viewer, plus managing security policies and findings, and approving changes
FinOps Reviewer Viewer, plus managing cost policies and findings, and approving changes
Auditor Reading and exporting the audit log, and viewing integrations
AI Agent Identity A governed machine identity with read-only resource access

The permission catalog

Section titled “The permission catalog”
Permission Allows
resource.read Reading the resource inventory
report.read Reading reports
change.propose Proposing changes
change.approve Approving proposed changes
plan.run Running plans
drift.manage Managing drift, including mapping corrections
workflow.trigger Triggering workflows such as scans
application.manage Managing applications, environments, teams, and ownership
integration.read Viewing integrations
integration.manage Managing AWS connections, source control, and state sources
policy.security.manage Managing security policies
finding.security.manage Managing security findings
policy.cost.manage Managing cost policies
finding.cost.manage Managing cost findings
org.manage Managing organization settings
member.read Viewing members
member.manage Inviting, deactivating, and changing members’ roles
audit.read Reading the audit log
audit.export Exporting the audit log

Some permissions correspond to capabilities that are still being built. They are in the catalog so the role model is stable as those capabilities land, rather than requiring a permissions migration each time.

How enforcement works

Section titled “How enforcement works”

Authorization is checked at the API, on every request, after authentication. The interface also hides what you cannot use, but that is a convenience — the API is the enforcement point, and calling an endpoint directly does not bypass it.

An unknown permission key fails closed: it denies rather than allows.

Tenant isolation

Section titled “Tenant isolation”

Roles operate within your organization. There is no role, including Platform Administrator, that can see another organization’s data. Isolation is enforced on every query rather than by permission checks, so it does not depend on a role being configured correctly.

Where to go next

Section titled “Where to go next”