Three roles cover most teams
| Role | Can do | Cannot do |
|---|---|---|
| Viewer | Read logs, traces, dashboards | Run tasks, change anything |
| Operator | Run tasks on assigned devices | Change policy, manage members |
| Admin | Everything: policy, members, keys | — (audited like everyone else) |
Principles before mechanics
- Least privilege: operators do not get admin just because it is easier.
- Named accounts: shared logins erase the whole point of an audit trail.
- Policy changes are reviews, not tweaks: every change is visible to everyone with access.
Pair permissions with the vault
Permissions say who may run; the key vault says who may spend. A viewer with a raw key in their .env is an operator in disguise — so keys stay in the vault and members get revocable access, per the revocation guide.
Keep it boring
The best permission system is one nobody thinks about: three roles, rare changes, everything logged. If members regularly need exceptions, the roles are wrong, not the members — revisit central policy instead.