> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions/granular-rbac-permissions-reference.md).
# Granular RBAC Permissions Reference (Beta)
Full capability-by-capability permissions reference for PCD's Granular Role-Based Access Control (Beta): what each of the six roles can do, grouped by resource area.
## Overview
{% hint style="danger" %}
**Beta**
Granular Role-Based Access Control is currently in **beta**. Production use is not recommended at this time. If these role options are not available in your deployment, contact Platform9 support.
{% endhint %}
This page lists what each of the six granular RBAC roles can do, grouped by resource area. **Yes** means the role can perform that capability; **No** means it cannot. For role definitions and how to assign these roles to users, see [Granular RBAC Roles (Beta)](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions/granular-rbac-roles.md).
{% hint style="info" %}
**Scope of this reference**
This reference covers the identity, compute, storage, and networking capabilities that space.vars.product\_name's policy engine enforces. Some areas are not yet covered by this policy engine and are intentionally omitted rather than shown as denied. These include compute cluster and blueprint management, service agent administration, custom roles, audit logging, monitoring, and add-on services such as Kubernetes as a Service, DNS as a Service, and Load Balancer as a Service.
While Granular RBAC is in beta, a small number of cells on this page may not yet match what the platform enforces. This reference documents the intended behavior for each role.
{% endhint %}
## Domains & Tenants
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| -------------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Domains: Read - list all domains (global) | Yes | Yes | No | No | No | No |
| Domains: Read - list domains assigned to me | Yes | Yes | Yes | No | No | No |
| Tenants: Read - list all tenants (global) | Yes | Yes | No | No | No | No |
| Tenants: Read - list tenants in scope | Yes | Yes | Yes | Yes | Yes | Yes |
| Tenants: Read - get tenant details | Yes | Yes | Yes | Yes | Yes | Yes |
| Tenants: Create - tenant in a domain | Yes | Yes | No | No | No | No |
| Tenants: Update - rename or edit tenant | Yes | Yes | No | No | No | No |
| Tenants: Delete - delete tenant | Yes | Yes | No | No | No | No |
| Cross-tenant resources: Read - view resources owned by other tenants | Yes | Yes | Yes | No | No | No |
*9 capabilities.*
## Users, Groups & Role Assignments
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| --------------------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Domain User: Create - provision user in domain | Yes | Yes | Yes | No | No | No |
| Domain User: Read - list / get user | Yes | Yes | Yes | No | Yes | No |
| Domain User: Update profile / password / status | Yes | Yes | Yes | No | Yes | No |
| Domain User: Update enable / disable user | Yes | Yes | Yes | No | Yes | No |
| Domain User: Delete remove user from domain | Yes | Yes | Yes | No | No | No |
| Group: Create - domain group | Yes | Yes | Yes | No | No | No |
| Group: Read list / get | Yes | Yes | Yes | Yes | Yes | No |
| Group: Update group membership | Yes | Yes | Yes | No | No | No |
| Group: Delete group | Yes | Yes | Yes | No | No | No |
| User to Tenant assignment: Create add existing user to tenant | Yes | Yes | Yes | No | Yes | No |
| User to Tenant assignment: Delete - remove user from tenant | Yes | Yes | Yes | No | Yes | No |
| Role Binding (tenant): Create / Update / Delete role binding within tenant | Yes | Yes | Yes | No | Yes | No |
| Role Binding (tenant): Read | Yes | Yes | Yes | No | Yes | No |
| Role Binding (cross tenant in domain): Create / Update / Delete | Yes | Yes | Yes | No | No | No |
| Role Binding (cross-domain): Create / Update / Delete (with explicit grant) | Yes | Yes | No | No | No | No |
| IdP Binding: Create bind external IdP to domain | Yes | Yes | Yes | No | No | No |
| IdP Binding: Read list / get | Yes | Yes | Yes | No | No | No |
| IdP Binding: Update - rotate cert / group mappings | Yes | Yes | Yes | No | No | No |
| IdP Binding: Delete - unbind IdP | Yes | Yes | Yes | No | No | No |
*19 capabilities.*
## Quotas
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| ---------------------------------------------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Quota - Security Groups per tenant: Update set | Yes | No | No | No | No | No |
| Quota - Security Groups per tenant: Read usage | Yes | Yes | Yes | Yes | Yes | Yes |
| Quota - Security Group Rules per tenant: Update set | Yes | No | No | No | No | No |
| Quota - Security Group Rules per tenant: Read usage | Yes | Yes | Yes | Yes | Yes | Yes |
| Tenant Quota - compute (vCPU, RAM, instances): Update - set tenant quota | Yes | No | No | No | No | No |
| Tenant Quota - compute: get quota + usage | Yes | Yes | Yes | Yes | Yes | Yes |
| Tenant Quota - storage (GB, volumes, snapshots): Update - set tenant quota | Yes | No | No | No | No | No |
| Tenant Quota - storage: Read | Yes | Yes | Yes | Yes | Yes | Yes |
| Tenant Quota - network (floating IPs, networks, routers, security groups): Update - set tenant quota | Yes | No | No | No | No | No |
| Tenant Quota - network: Read | Yes | Yes | Yes | Yes | Yes | Yes |
| Per-user Quota within tenant: Update - set | Yes | No | No | No | Yes | No |
| Per-user Quota within tenant: Read | Yes | Yes | Yes | Yes | Yes | Yes |
*12 capabilities.*
## Platform-Managed Compute Resources
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| ---------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Host (hypervisor): Read - list hosts (full detail) | Yes | No | No | No | No | No |
| Host (hypervisor): Read - aggregate CPU/RAM/GPU capacity | Yes | Yes | No | No | No | No |
| Host (hypervisor): Update - drain / maintenance mode | Yes | No | No | No | No | No |
| Host (hypervisor): Update - evacuate VMs from host | Yes | No | No | No | No | No |
| Platform Image: Create - upload image | Yes | Yes | Yes | No | No | No |
| Platform Image: Read - list / get image | Yes | Yes | Yes | Yes | Yes | Yes |
| Platform Image: Update - metadata / properties | Yes | Yes | Yes | No | No | No |
| Platform Image: Update - visibility (public/private/shared) | Yes | Yes | Yes | No | No | No |
| Platform Image: Delete - platform image | Yes | Yes | Yes | No | No | No |
| Domain-published Image: Create - publish image to domain catalog | Yes | Yes | Yes | No | No | No |
| Domain-published Image: Read - list domain catalog | Yes | Yes | Yes | Yes | Yes | No |
| Domain-published Image: Delete - unpublish from domain | Yes | Yes | Yes | No | No | No |
| Platform Flavor: Create - define platform flavor | Yes | Yes | Yes | No | No | No |
| Platform Flavor: Read - list / get flavors | Yes | Yes | Yes | Yes | Yes | Yes |
| Platform Flavor: Update - flavor extra-specs | Yes | Yes | Yes | No | No | No |
| Platform Flavor: Delete - platform flavor | Yes | Yes | Yes | No | No | No |
| Tenant-scoped Flavor: Create - private tenant flavor | Yes | Yes | Yes | No | Yes | No |
| Tenant-scoped Flavor: Read / Update / Delete | Yes | Yes | Yes | No | Yes | No |
| Volume Type: Create - volume type | Yes | Yes | Yes | No | No | No |
| Volume Type: Read - list / get | Yes | Yes | Yes | Yes | Yes | No |
| Volume Type: Update - settings | Yes | Yes | Yes | No | No | No |
| Volume Type: Delete - volume type | Yes | Yes | Yes | No | No | No |
| Tenant Default Volume Type: Update - set default for tenant | Yes | No | No | No | No | No |
*23 capabilities.*
## Virtual Machines
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| --------------------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Virtual Machine: Create - boot VM | Yes | Yes | Yes | Yes | Yes | Yes |
| Virtual Machine: Read - list / get | Yes | Yes | Yes | Yes | Yes | Yes |
| Virtual Machine: Update - rename / tags / metadata | Yes | Yes | Yes | Yes | Yes | Yes |
| Virtual Machine: Update - resize (flavor change) | Yes | Yes | Yes | Yes | Yes | Yes |
| Virtual Machine: Update - reconfigure (NIC, disk) | Yes | Yes | Yes | Yes | Yes | Yes |
| Virtual Machine: Update - live migrate | Yes | Yes | Yes | No | Yes | No |
| Virtual Machine: Update - cold migrate | Yes | Yes | Yes | No | Yes | No |
| Virtual Machine: Delete - terminate VM | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Power: Start | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Power: Stop | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Power: Reboot (soft) | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Power: Reboot (hard) | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Power: Pause / Unpause | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Power: Suspend / Resume | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Console: Read | Yes | Yes | Yes | Yes | Yes | Yes |
| VM Snapshot: Create snapshot VM | Yes | Yes | Yes | Yes | Yes | Yes |
| SSH Key Pair: Create / Read / Update / Delete (own key pair) | Yes | Yes | Yes | Yes | Yes | Yes |
| SSH Keypair: Manage (Create / Read / Update / Delete) other users' keypairs | Yes | Yes | No | No | No | No |
*18 capabilities.*
## Storage
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| --------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Volume: Create provision volume | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume: Read list / get | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume: Update resize | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume: Update retype | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume: Update metadata | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume: Delete volume | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume Attachment: Create attach volume to VM | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume Attachment: Delete detach volume | Yes | Yes | Yes | Yes | Yes | Yes |
| Volume Snapshot: Create snapshot volume | Yes | Yes | Yes | Yes | Yes | No |
| Volume Snapshot: Read list / get | Yes | Yes | Yes | Yes | Yes | No |
| Volume Snapshot: Update restore from snapshot | Yes | Yes | Yes | Yes | Yes | No |
| Volume Snapshot: Delete volume snapshot | Yes | Yes | Yes | Yes | Yes | No |
*12 capabilities.*
## Networking
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| --------------------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| External Network: Create - provision external network | Yes | Yes | No | No | No | No |
| External Network: Read | Yes | No | No | No | No | No |
| External Network: Read - name only (consumable handle) | Yes | Yes | Yes | Yes | Yes | No |
| External Network: Update - settings / pool | Yes | Yes | No | No | No | No |
| External Network: Delete - external network | Yes | No | No | No | No | No |
| External Network Subnet: Read | Yes | No | No | No | No | No |
| Other tenants' Floating IPs: Read visibility into other tenants' public IPs | Yes | No | No | No | No | No |
| Floating IP: Create - request floating IP from the external network pool | Yes | Yes | Yes | Yes | Yes | No |
| Floating IP: Read list / get | Yes | Yes | Yes | Yes | Yes | No |
| Floating IP: Update associate / disassociate with VM | Yes | Yes | Yes | Yes | Yes | No |
| Floating IP: Delete release floating IP | Yes | Yes | Yes | Yes | Yes | No |
| Tenant Network: Create tenant-scoped network | Yes | Yes | Yes | Yes | Yes | No |
| Tenant Network: Read list / get | Yes | Yes | Yes | Yes | Yes | Yes |
| Tenant Network: Update settings | Yes | Yes | Yes | Yes | Yes | No |
| Tenant Network: Delete tenant network | Yes | Yes | Yes | Yes | Yes | No |
| Subnet (tenant): Create / Read / Update / Delete | Yes | Yes | Yes | Yes | Yes | No |
| Router: Create - tenant router | Yes | Yes | Yes | Yes | Yes | No |
| Router: Read - list / get | Yes | Yes | Yes | Yes | Yes | No |
| Router: Update - attach interface / set gateway | Yes | Yes | Yes | Yes | Yes | No |
| Router: Delete - router | Yes | Yes | Yes | Yes | Yes | No |
| Port: Create - port | Yes | Yes | Yes | Yes | Yes | Yes |
| Port: Read - list / get | Yes | Yes | Yes | Yes | Yes | Yes |
| Port: Update - port settings | Yes | Yes | Yes | Yes | Yes | No |
| Port: Delete - port | Yes | Yes | Yes | Yes | Yes | No |
*24 capabilities.*
## Security Groups
| Capability | Platform Admin | Service Provider Domain Admin | Customer Domain Admin | Application User | Tenant Admin | Tenant User |
| -------------------------------------------------------------------------------- | -------------- | ----------------------------- | --------------------- | ---------------- | ------------ | ----------- |
| Security Group: Create new security group in tenant | Yes | Yes | Yes | Yes | Yes | No |
| Security Group: Read list security groups in tenant | Yes | Yes | Yes | Yes | Yes | Yes |
| Security Group: Read get security group details with rules | Yes | Yes | Yes | Yes | Yes | Yes |
| Security Group: Update rename / description / tags | Yes | Yes | Yes | Yes | Yes | No |
| Security Group: Delete security group (blocked if attached to any port) | Yes | Yes | Yes | Yes | Yes | No |
| Default Security Group: Read auto-created per tenant | Yes | Yes | Yes | Yes | Yes | Yes |
| Default Security Group: Reset - restore default security group rules | Yes | Yes | Yes | Yes | Yes | No |
| Security Group Rule: Create inbound rule | Yes | Yes | Yes | Yes | Yes | No |
| Security Group Rule: Create outbound rule | Yes | Yes | Yes | Yes | Yes | No |
| Security Group Rule: Create rule that references another security group | Yes | Yes | Yes | Yes | Yes | No |
| Security Group Rule: Read list rules | Yes | Yes | Yes | Yes | Yes | Yes |
| Security Group Rule: Read get rule details | Yes | Yes | Yes | Yes | Yes | Yes |
| Security Group Rule: Delete rule | Yes | Yes | Yes | Yes | Yes | No |
| Security Group Membership (VM): Update add security group to running VM | Yes | Yes | Yes | Yes | Yes | Yes |
| Security Group Membership (VM): Update remove security group from running VM | Yes | Yes | Yes | Yes | Yes | Yes |
| Security Group Membership (VM): Read list security groups applied to VM | Yes | Yes | Yes | Yes | Yes | Yes |
| Shared Security Group: Create share security group with another tenant in domain | Yes | Yes | Yes | No | No | No |
| Shared Security Group: Read list shared security groups | Yes | Yes | Yes | Yes | Yes | Yes |
| Shared Security Group: Delete revoke share | Yes | Yes | Yes | No | No | No |
*19 capabilities.*
## Related Pages
* [Granular RBAC Roles (Beta)](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions/granular-rbac-roles.md): role definitions and scope.
* [RBAC Roles and Permissions](/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions.md): the legacy Admin, Self-Service User, and ReadOnly roles.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.platform9.com/private-cloud-director/identity-and-multi-tenancy/rbac-roles-and-permissions/granular-rbac-permissions-reference.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.