Groups, roles, and permissions

Learn how groups, roles, and permissions work together in Cloud Management Platform (CMP) and how to use them

8 minute read

Groups

Groups associate users with environments and help you manage permissions, approval processes, and quotas. A group can represent a business unit, department, team, project, or any other set of users.

In the navigation menu, select Groups to open the Groups page, where you can view your groups along with their quotas, members, and resources across up to three levels of subgroups.

Each group has the same set of roles that users can belong to, which grant permissions within that group. For example, a user could be a requester in one group and an approver in another.

Groups are stored hierarchically, allowing you to model organizational structures and delegate each group’s administration to the appropriate person.

You can define any group type, but you must explicitly allow new group types to order resources. Go to Admin > Miscellaneous Settings, select the UI tab, and edit the settings to specify Group Types shown on Order form.

Quotas

Use quotas to limit the cost and quantity of resources that a group provisions. A quota applies to all users in the group and specifies the maximum they can collectively use. You can also configure notifications when quota limits are exceeded. The quotas dashboard displays the configured limits, the used quantity, the delegated quantity (if any), and the remaining quantity available.

You can set quotas for the following:

Servers: The total number of servers the members can provision.
Rate in USD/month: The maximum amount the group can spend each month to provision resources.
CPU Count: The maximum number of CPUs the group can provision.
Memory Size: The maximum amount of memory the members can collectively provision.
Disk Size: The maximum amount of disk storage the members can collectively use.

Group roles

Roles grant specific privileges to group members. Those privileges apply only to the resources and environments associated with the group. There are six built-in roles on groups, and you can configure your own.

Example: a user with the default Requestor role on a group can request resources in the group’s environments, while a Resource Admin on that same group can manage any of the group’s servers.

Built-in roles

Select Admin > Roles and open the Group Roles tab. Each user in a group can be assigned any combination of these roles, and the roles they hold determine which individual and group actions they can perform. Administrators can customize the permissions for each role, or delete roles that are not needed.

Role	Description	Default permissions
Approver	Approves orders submitted by other users. You can grant the approver role to a user, or create a group with approval permissions and add users to it.	order.approve order.view order.change_attributes
Group Admin	Manages the group’s organizational aspects: membership and permissions, subgroup creation and management, and delegation of responsibilities to other group members.	group.view group.change_attributes group.delete group.create_subgroup group.manage_members group.manage_subgroup_quotas
Requestor	Submits orders to create, modify, or delete servers, individually or within a group they belong to.	order.submit
Resource Admin	Manages technical configurations for the group, such as parameters and networks. Can also manage blueprints and servers.	order.submit server.view server.control_power server.manage_snapshots server.manage_nics server.change_resources server.console server.remote_terminal server.manage_applications server.change_attributes server.manage_labels server.manage_parameters server.delete server.manage_credentials server.view_handler_specific_details resource.view resource.change_attributes resource.manage_parameters group.view group.change_attributes group.manage_networks group.manage_parameters blueprint.manage blueprint.any_group_can_deploy server.view_power_schedule server.manage_power_schedule server.add_disks server.remove_disks server.resize_disks resource.view_power_schedule resource.manage_power_schedule
Delegate Server Owner	Can be assigned to users in a server’s management groups to give them permissions comparable to the server’s owner.	server.view server.control_power server.manage_snapshots server.manage_nics server.change_resources server.console server.remote_terminal server.manage_applications server.change_attributes server.manage_labels server.manage_parameters server.delete server.manage_credentials server.view_handler_specific_details server.view_power_schedule server.manage_power_schedule server.add_disks server.remove_disks server.resize_disks
Viewer	Has basic permissions to view group servers, members, and activity.	order.view server.view resource.view group.view server.view_power_schedule resource.view_power_schedule

OneFuse roles

Role	Description	Default permissions (when OneFuse is licensed)
Workspace Admin	Manages workspace users and content for OneFuse.	group.create_subgroup group.manage_members module.view policy.list policy.manage policy.execute
Workspace Member	Manages workspace content, such as endpoints and policies, for OneFuse.	module.view policy.list policy.manage policy.execute
Workspace Executor	Runs workspace policies but cannot create, edit, or delete them.	module.view policy.list policy.execute
Workspace Viewer (The label may appear as “Viewer” if CMP was licensed first.)	Views workspace content, such as endpoints and policies, for OneFuse.	module.view

Restore defaults

Select Restore defaults to return all built-in roles to their default configuration. This also reinstates deleted built-in roles.
In the Actions column, select the curved arrow icon to restore an individual built-in role to its default configuration.

Neither action affects user-defined roles.

Duplicate roles

Duplicate an existing role and copy its permissions.

Select Admin > Roles.
In the Actions column, select the copy icon.
Add a label, unique name, and optional description for the duplicate role.
Select Duplicate.

Duplicated roles do not copy server actions, resource actions, or groups.

Special roles

The Roles page has a separate tab for special roles. Special roles are not assignable; they are determined by context. For example, the Resource Owner role applies whenever determining permissions for a resource that the user owns.

By default, special roles inherit all permissions for their object type. For example, a Server Owner can do anything to a server they own.

Role	Description	Default permissions
Job Owner	Permissions granted to owners of jobs.	job.view job.view_logs job.cancel job.rerun
Resource Owner	Permissions granted to owners of resources.	resource.view resource.change_attributes resource.manage_parameters resource.all_actions resource.view_power_schedule resource.manage_power_schedule
Server Owner	Permissions granted to owners of servers.	server.view server.control_power server.manage_snapshots server.manage_nics server.change_resources server.console server.remote_terminal server.manage_applications server.change_attributes server.manage_labels server.manage_parameters server.delete server.manage_credentials server.view_handler_specific_details server.all_actions server.view_power_schedule server.manage_power_schedule server.add_disks server.remove_disks

Delegated group administration

Delegated group administration lets organizations decentralize CMP administration at the group level by giving select users the ability to administer entire groups. Because group admins can, by default, make changes only within their group, not across the entire instance, this is a safe way to delegate administrative responsibilities to match your organizational structure.

Example: Barbara is the technical head of a company’s investment banking division. Giving her the Group Admin role for the group named Investment Banking lets her administer it. Because groups can be nested, she can create subgroups for their subdivisions and grant the Group Admin role to other users on them (unless that role has been customized to remove those permissions). For finer-grained delegation, associate permissions such as group.create_subgroup and group.manage_members with roles, then assign users to those roles in a group.

The Group Admin role does not imply any other roles. A group admin cannot request or approve orders unless they or another group admin grants them the appropriate roles and privileges.

Change a user’s role

You can configure the roles granted to a user for a particular group in the group’s details view or on the user’s profile page.

Inheritance of group permissions

On the Groups list page, you can enable inheritance of group permissions from parent groups to subgroups. This applies to both internal and external users, but only to group roles.

When inheritance is first enabled, all currently configured users and their roles on a parent group are inherited by all its subgroups. Inherited permissions are marked as such in the UI and cannot be removed from the subgroups.

From then on, while inheritance is enabled, any change to permissions on a parent group propagates to its subgroups. This applies when a user is assigned a new group role (including through an External User Sync action) or when a role is removed from a user in that group. A new subgroup also automatically gets its parent group’s permissions on creation.

You can disable inheritance from the Groups list page when it is no longer needed. Existing permissions are then no longer considered inherited and can be removed, but they are not removed automatically.

Customize roles

The Roles page shows all group, admin, and special roles and lets you edit, create, and delete them.

The set of permissions a user has in a particular context is the sum of all the permissions across the group roles they have in the applicable group, any admin permissions across their admin roles (potentially in the applicable tenant), and any special roles that apply.

A group role and a special role differ in effect. With a group role, the permission applies to all objects in the group. With a special role, it applies only to objects that match that role’s criteria. For example, the server.view permission in the default Viewer role lets a user view all servers in the group, while the same permission in the default Server Owner role lets a user see only the servers they own.

When editing a group or special role, you can configure both permissions for CMP functionality (such as server.manage_snapshots) and permission to run server actions and resource actions. For actions, you have two options: grant server.all_actions and resource.all_actions to run all server and resource actions, or use the Server Actions and Resource Actions fields to allow only specific actions.

Special roles cannot be deleted or renamed. When editing one, the permissions and actions fields are adjusted to the role to improve clarity. For example, giving non-server permissions to, or associating resource actions with, the Server Owner role does not make sense, so those options are not available.