Permissions and roles
Oriel authorizes with permission strings. Roles are named permission bundles; authorization decisions use resolved permissions, not role names.
Built-in roles
Section titled “Built-in roles”The built-in role slug set is closed:
| Role | Purpose |
|---|---|
owner |
All permissions. |
admin |
Workspace administration without workspace:delete. |
editor |
Query, dashboards, alerts, silences, saved queries, services, flags, SLOs, experiments, annotations, and channel read. |
viewer |
Query plus read-only project, dashboard, alert, flag, SLO, and experiment access. |
Built-in roles are immutable.
Permission set
Section titled “Permission set”| Permission | Project-scopable |
|---|---|
telemetry:query |
Yes |
projects:read |
Yes |
projects:manage |
Yes |
environments:manage |
Yes |
services:manage |
Yes |
queries:manage |
Yes |
dashboards:read |
No |
dashboards:manage |
No |
alerts:read |
Yes |
alerts:manage |
Yes |
silences:manage |
Yes |
channels:read |
No |
channels:manage |
No |
members:read |
No |
members:manage |
No |
roles:read |
No |
roles:manage |
No |
tokens:read |
No |
tokens:manage |
No |
audit:read |
No |
workspace:manage |
No |
workspace:delete |
No |
flags:read |
Yes |
flags:write |
Yes |
flags:manage |
Yes |
annotations:read |
No |
annotations:write |
No |
slos:read |
No |
slos:manage |
No |
experiments:read |
Yes |
experiments:manage |
Yes |
Built-in role permissions
Section titled “Built-in role permissions”| Role | Permissions |
|---|---|
owner |
Every permission. |
admin |
telemetry:query, projects:read, dashboards:read, alerts:read, dashboards:manage, alerts:manage, silences:manage, queries:manage, services:manage, channels:read, projects:manage, environments:manage, members:read, members:manage, roles:read, roles:manage, tokens:read, tokens:manage, channels:manage, audit:read, workspace:manage, flags:read, flags:write, flags:manage, annotations:read, annotations:write, slos:read, slos:manage, experiments:read, experiments:manage |
editor |
telemetry:query, projects:read, dashboards:read, alerts:read, dashboards:manage, alerts:manage, silences:manage, queries:manage, services:manage, channels:read, flags:read, flags:write, annotations:read, annotations:write, slos:read, slos:manage, experiments:read, experiments:manage |
viewer |
telemetry:query, projects:read, dashboards:read, alerts:read, flags:read, annotations:read, slos:read, experiments:read |
No-escalation rule
Section titled “No-escalation rule”A grantor may only grant or revoke permissions that are already included in the
grantor’s effective permissions at the target scope. Attempts to widen a member
or token beyond the caller’s authority fail with ORL-3006.