# Blueprint ordering permissions

> Control which users can order (deploy) a blueprint

---

Site [llms.txt](/llms.txt)

---

A user can order a blueprint if they are in a group assigned to it as a deploy group, and their role in that group includes the required ordering permission: `order.submit` by default, or a permission configured in the blueprint's [Deployment Permissions](#deployment-permissions) field.

## Group-based access

A user can order a blueprint if:

- The user is a member of a group assigned to the blueprint as a deploy group.
- The user has a role in that group that includes the `order.submit` permission.

### Add group permissions on blueprints

1. Go to **Catalog** and open a blueprint to edit.
1. Go to the **Groups** tab and select **Edit**.
1. Choose the groups that can **Deploy** or **Manage and deploy**, and decide whether to enable **Any group can deploy**.
1. Select **Save changes**.

### The "Any group can deploy" permission

<div class="alert alert-warning" role="alert">


To edit the "Any group can deploy" checkbox, you must have the `blueprint.any_group_can_deploy` permission. On new installations this permission is not included in any role by default, so an administrator must add it to a role. (On instances upgraded from an earlier release, it is granted to any role that already had `blueprint.manage`.) Assign it with caution: selecting the checkbox allows any group to order the blueprint.
</div>


Assign the permission to an existing role:

1. Go to **Admin** > **Roles**.
1. Select the pencil icon to edit a role.
1. In the **Permissions** dropdown, select `blueprint.any_group_can_deploy`.
1. Select **Save changes**.

Create a new role:

1. Go to **Admin** > **Roles**.
1. Select **Add**.
1. Provide a **Label** and **Name** for the role.
1. In the **Permissions** dropdown, select `blueprint.any_group_can_deploy`.
1. Select **Create**.

## Deployment permissions

Users who hold a permission specified in a blueprint's **Deployment Permissions** field, via a role in a deploy group assigned to the blueprint, can order it. This is a per-blueprint setting and does not affect other blueprints.

**Use case example:** An "onboarding" blueprint should be visible only to group administrators with `group.manage_members`, not to all users with `order.submit`. Set `group.manage_members` as the deployment permission. Only users who hold that permission in a relevant deploy group can see it.

See [Permissions](/docs/cmp/configure/access-and-security/groups-roles-permissions/permissions/) for a list of available permissions.

### Configure deployment permissions

1. Go to **Catalog** and open a blueprint to edit.
1. In the **Deployment Permissions** field, select one or more permissions.

   ![Screenshot of the Edit Blueprint form with Deployment Permissions highlighted.](/img/cmp/use/blueprints/share-and-control-access/ordering-permissions/edit-blueprint.png)

1. Select **Save changes**.

**Result:** Users who hold any of the selected permissions via a role in a deploy group for that blueprint can order it.