Capabilities
A capability is a named platform permission, written platform.<area>.<action>. You grant a capability to a role, and every user with that role can use the feature it gates. The built-in admin role holds every capability below; other roles hold the subset they need.
A capability that governs a table area also grants the matching table actions: a .read grants read and list on that area’s tables, and a .write grants create, update, and delete. The second table below lists which tables each area covers.
Every capability
| Capability | Tier | What it allows |
|---|---|---|
platform.agents.read | Read | View AI agents, runs, grants, and triggers |
platform.agents.write | Configure | Create, edit, dispatch, pause, resume, retire AI agents and manage their tool grants |
platform.ai.model.write | Configure | Choose the tenant default AI model |
platform.analytics.read | Read | View dashboards and reports |
platform.analytics.write | Configure | Create dashboards and reports |
platform.approvals.access | Execute | Access the approvals inbox |
platform.approvals.read | Read | View approval policies |
platform.approvals.write | Configure | Manage approval policies |
platform.apps.develop | Manage | Build applications in App Studio |
platform.apps.install | Execute | Install applications from marketplace |
platform.apps.read | Read | View installed applications |
platform.archive.read | Read | View archived (deleted) records |
platform.archive.write | Configure | Restore archived records back to their source tables |
platform.audit.message_raw.read | Read | View raw historical AI audit messages |
platform.billing.manage | Configure | Choose a plan, open the payment page and manage the card for this instance |
platform.branding.read | Read | View tenant branding (logo, colours, email shell) |
platform.branding.write | Configure | Change tenant branding and upload brand assets |
platform.catalog.read | Read | View service catalog configuration |
platform.catalog.write | Configure | Manage service catalog |
platform.cmdb.admin | Manage | Seed and administer CMDB tables |
platform.cmdb.read | Read | View CMDB configuration items and dependencies |
platform.cmdb.sync | Execute | Trigger CMDB sync from discovery |
platform.cmdb.write | Configure | Edit CMDB records and mappings |
platform.credentials.read | Read | View platform credential metadata: names, types and rotation status, never secret material |
platform.credentials.write | Configure | Create, rotate, and delete platform credentials (encrypted secret store) |
platform.data.export | Execute | Export a table’s records, timeline, relationships, attachment manifest and audit trail |
platform.devices.scripts.manage | Configure | Create, edit, enable/disable, and delete device scripts in the RMM script library |
platform.discovery.read | Read | View discovery sources, assets, and classification |
platform.discovery.write | Configure | Manage discovery sources and classification rules |
platform.external.config.read | Read | View tenant external-capability configuration (web_fetch / email / graph_query) |
platform.external.config.write | Configure | Configure tenant external capabilities: enable/disable and bind credentials |
platform.external.email.send | Execute | Send outbound email via the send_email capability |
platform.external.entra.read | Read | Read Microsoft Entra ID (Graph) directory state via the entra_query capability |
platform.external.graph.content.read | Read | Search and read Microsoft 365 content (Exchange mail, SharePoint/OneDrive documents) via the graph_search tool |
platform.external.intune.read | Read | Read Microsoft Intune (Graph) device state via the intune_query capability |
platform.external.mcp.call | Execute | Call admin-marked read tools on tenant-configured MCP servers through the Source Fabric (query_source) |
platform.external.probe.icmp | Execute | Ask an on-prem gateway agent whether an inventoried configuration item answers a ping (probe_ci) |
platform.external.rest.call | Execute | Call tenant-configured external REST endpoints via the call_rest_capability tool |
platform.external.sql.read | Read | Read registered external SQL databases through the Source Fabric (query_source declarative reads) |
platform.external.web.read | Read | Fetch external web pages via the web_fetch capability |
platform.fleet.operate | Manage | Ship a platform version to the dedicated stacks and read the fan-out |
platform.gateway.read | Read | View gateway agents and data logs |
platform.gateway.write | Configure | Manage gateway agents and registration |
platform.governance.read | Read | View tenant identity-governance scan settings |
platform.governance.write | Configure | Change tenant identity-governance scan settings (thresholds, master switch) |
platform.iam.read | Read | View identity & access management |
platform.iam.write | Configure | Manage users, groups, and roles |
platform.instances.delete | Manage | Deprovision a tenant instance and destroy its database and DNS |
platform.instances.read | Read | View the tenant instance registry (subdomains, status, endpoints) |
platform.instances.write | Configure | Approve or reject instance requests, change a tenant’s plan and suspension state, set network posture, link stack agents, resync the instance mirror |
platform.judgments.read | Read | View judgment definitions and per-decision audit rows |
platform.judgments.write | Configure | Create, edit, enable/disable, and run judgments |
platform.memory.read | Read | Browse the operational memory archive (per-document source-table permission still applies) |
platform.memory.write | Configure | Correct, retire, restore, and endorse operational memory documents |
platform.navigation.read | Read | View workspaces and menus |
platform.navigation.write | Configure | Configure workspaces and menus |
platform.network.read | Read | View the dedicated-stack ingress-posture request (access level + allowlist) |
platform.network.write | Configure | Request a dedicated-stack ingress posture (tightening auto-applies; loosening is operator-reviewed) |
platform.notifications.read | Read | View notification templates |
platform.notifications.write | Configure | Manage notification templates |
platform.privacy.read | Read | View what the AI privacy shield masks before anything reaches a model provider |
platform.privacy.write | Configure | Change what a model provider is allowed to see about people and classified fields |
platform.rules.read | Read | View business rules |
platform.rules.write | Configure | Create and edit business rules |
platform.sam.read | Read | View license metrics, entitlements, usage, and compliance positions |
platform.sam.reconcile | Execute | Trigger license reconciliation |
platform.sam.write | Configure | Create and edit license metrics and entitlements |
platform.scripts.approve | Manage | Approve scripts for live execution |
platform.scripts.execute | Execute | Execute scripts on-demand (dry-run and live) |
platform.scripts.read | Read | View scripts and script execution history |
platform.scripts.write | Configure | Create and edit scripts |
platform.servicedef.materialize | Execute | Trigger on-demand service materialization and acknowledge drift |
platform.servicedef.read | Read | View services, offerings, SLAs, CMDB edges, and service membership |
platform.servicedef.write | Configure | Create and edit services, offerings, SLAs, and declare CMDB edges |
platform.servicehub.access | Execute | Access the self-service portal |
platform.skills.body.read | Read | View AI skill prompt bodies |
platform.support.access | Manage | Ask a customer for time-boxed access to their instance, and open a session once they consent |
platform.support.consent | Configure | Allow or refuse FlowLakes support access to this instance, and end it at any time |
platform.tables.read | Read | View table schemas |
platform.tables.system.list | List | Discover system table names |
platform.tables.write | Configure | Create and modify table schemas |
platform.translations.read | Read | View translations and language settings |
platform.translations.write | Configure | Add, edit, and delete translations; change tenant language settings |
platform.workflows.read | Read | View workflow definitions |
platform.workflows.write | Configure | Create and edit workflows |
platform.workitems.read | Read | View work items (instruction inbox) and their findings/plans |
platform.workitems.write | Configure | Submit and cancel work items |
Areas that govern tables
When a capability’s area appears here, holding that capability also authorizes the listed tables. Custom tables you create are not in this map and use per-table permissions instead.
| Area | Tables it governs |
|---|---|
agents | fl_agents, fl_agent_runs, fl_agent_tool_grants, fl_agent_trigger_links |
analytics | fl_dashboards, fl_reports, fl_dashboard_reports, fl_widgets, fl_report_definitions, fl_data_sources, fl_connector_registry |
approvals | fl_approval_policies, fl_approval_requests, fl_approvals, fl_approval_decisions |
catalog | service_catalog_items, service_catalog_categories, service_catalog_forms, service_catalog_form_fields, service_requests, fl_tasks |
cmdb | fl_cmdb_items, configuration_items, fl_discovery_cmdb_mappings, fl_device_state |
credentials | fl_credentials |
discovery | fl_discovery_agents, fl_discovery_sources, fl_discovery_assets, fl_discovery_relationships, fl_discovery_scans, fl_discovery_cmdb_mappings, fl_discovery_profiles, fl_discovery_profile_runs, fl_discovery_profile_phase_records, fl_discovery_pipeline_stats, fl_discovery_asset_events |
gateway | fl_gateway_agents, fl_gateway_api_keys, fl_gateway_data_log |
iam | users, roles, permissions, user_role_assignments, role_permission_mappings, groups, group_memberships, group_role_assignments, field_permissions |
judgments | fl_judgments, fl_judgment_decisions |
navigation | workspaces, modules, menu_items, fl_action_buttons, fl_action_button_executions |
notifications | fl_notification_rules, fl_notification_templates, fl_notification_queue, notifications |
rules | business_rules |
scripts | scripts, script_executions |
servicedef | fl_services, fl_service_memberships, fl_service_drift_events, fl_service_offerings, fl_service_level_agreements, fl_cmdb_edges |
skills | fl_skills |
tables | dynamic_table_definitions, dynamic_field_definitions, fl_table_registry, fl_choices, fl_related_config, choice_lists, choice_options |
workflows | workflows, workflow_triggers, workflow_actions, workflow_executions, action_executions, workflow_templates |
workitems | fl_work_items |
Related
- Identity and access explains roles, groups, and how a capability is granted.
- Glossary: every platform term.