Roles and permissions
Ecosystem has a permission model based on roles (RBAC). Each user is assigned one or more roles by their Company Owner, which precisely determine what they can view, create, edit or delete — and on which environment.
How it works
- A role groups a set of permissions (view, create, edit, delete, deploy, etc.).
- Permissions apply according to two logics:
- The business object — triggers, workflows, dictionaries, credentials, traces, etc. Each object type has its own permission matrix.
- The environment — for some objects, permissions also depend on the environment type. Three categories are taken into account:
- Development: the environment marked as the development environment (see Manage environments).
- Other environments: non-production environments that are not the development environment (staging, UAT, etc.).
- Production: the environment marked Production.
- Roles are cumulative: a user can be assigned several roles. Effective permissions correspond to the union of the rights granted by each role.
- Viewer + Exploitation: read-only access to all objects, on all environments (including Production).
- Builder + Exploitation: building and testing on Development and Other environments, read-only in Production.
- Role assignment is done from the Administration — Users section, accessible to Company Owners and Advanced Builders (with limits on user creation).
Roles at a glance
Five roles cover the business profiles. The detail of each role is presented on the Available roles page, right after this one.
| Role | Scope | Ideal for |
|---|---|---|
| Viewer | Read on Development and Other env., trace replay | External developer, tester |
| Builder | Workflow building and testing outside Production | Integrator |
| Advanced Builder | Builder + Production deployment + role management | Technical lead |
| Exploitation | Production ops (traces, dictionaries) only | Support / ops team |
| Company Owner | Full company administration | Technical manager |
Permission matrix
The detailed tables are organized by theme:
| Page | Content |
|---|---|
| Workflows and triggers | Viewing, editing, versions, manual execution |
| Deployments and traces | Deployment per environment, trace replay and deletion |
| Dictionaries and credentials | Reading and editing values, secrets management |
| Organization and administration | Projects, folders, resources, users, environments |
Legend: ✅ Allowed · ❌ Not allowed
In the tables, Development and other env. groups the Development and Other environments. Production refers to the environment marked Production.
Key takeaways
- Production is always more protected. Deploying, accessing Production traces or editing dictionary values in Production requires at least the Advanced Builder or Exploitation role.
- Exploitation is the only role dedicated to Production ops. It allows acting on Production without touching workflow building or the Development and Other environments.
- Roles are cumulative. Combine them to cover a cross-cutting business need (e.g. building outside Production + supervising Production).
- The Company Owner is the only one who can create or delete users. The Advanced Builder can edit existing users and assign roles, but cannot create new ones.
- Role assignment is done from User management.