Roles

The Roles view is where user roles and their permissions are managed. DataStream ships four built-in roles, and on editions that include Advanced RBAC it lets you assemble custom roles from a catalog of permission sets.

---

To access the Roles view

• Go to the Home > Organization pane
• Click Manage Roles

-or-

• Click the hamburger menu on the top left
• Select Organization > Roles

The view contains the following essential components:

• Role table - Displays Role name, Description, Permissions count, and Assigned Users count
• Items per page - Controls pagination settings for role display
• Page navigation - Shows current page and total pages
• Action menu - Three-dot menu for additional role management options

Role Columns

The table lists all available roles in your organization with their key characteristics:

• Role name - Human readable name of the role. Built-in roles display a Built-in tag next to the name. Clicking the name opens the role detail drawer.

• Description - Details of the role, including the actions the role has permission to carry out

• Permissions - The number of permissions assigned to the role.

  Clicking on this value opens a breakdown list with two columns:

  • Permission Title - The name of the permission
  • Ability - The action the permission grants

  Click again to close the table.

• Assigned Users - Number of users the role has been assigned to in your organization.

  Clicking on this value opens a list displaying the e-mails and names of the assignees. Click again to close the list.

Actions Menu

The Action menu—the vertical ellipsis (⋮) on the right—opens a management menu. For custom roles, the available items are Manage role, Clone role, and Delete role (subject to your permissions). For built-in roles, only Clone role is available.

Role Details Drawer

Clicking a role's name opens a side drawer with a Role Details section showing Name, Description, Permissions (N) (expandable permission list), and Assigned Users (N) (expandable user list). The footer offers Manage role (custom roles only) and Clone role.

How Permissions Are Structured

Permissions exist at three levels. Knowing which level you are looking at explains most of what is otherwise confusing about the naming:

Level	What it is	Example
Permission	The atomic right the platform checks on a request	PIPELINE_EDIT
Permission set	A named bundle of permissions, offered in tiers per resource	PIPELINE_CONTRIBUTOR
Scope	The resource family the permission sets are grouped under	PIPELINE

A role holds permissions. What you assign when building a custom role is a permission set, and the sets are presented grouped by scope.

The same word therefore appears in several forms, and those forms are not duplicates of one another. PIPELINE is a scope, PIPELINE_ADMIN is a permission set, and PIPELINE_EDIT is a permission. Likewise the ROUTES scope offers QUICK_ROUTE_* and ADVANCED_ROUTE_* permission sets, which grant QUICKROUTE_* and ADVANCEDROUTE_* permissions.

A Permission Set Reaches Beyond Its Own Resource

A permission set grants the permissions its screens need in order to function, not only the permissions of the resource it is named after.

TARGET_ADMIN, for instance, grants full access to targets — and also read access to pipelines, detections, the library, proxies, the vault, and the audit log, because a target cannot be configured without seeing them.

So assigning one permission set grants read access to resources you did not name. Read a set's contents rather than inferring them from its name; the permission breakdown on the role's row lists exactly what the role ended up holding.

Built-in Roles

The system provides four built-in roles.

User

Read-only. The User role holds the read permission for nearly every resource and nothing else, with two qualifications: it also holds MSSP_SWITCH, so it can switch between tenants, and it holds no permission at all for API tokens, MFA, enrollment templates, statistics, live data, console logs, pipeline commits, or content settings.

Contributor

Read, create, and edit across the platform, with no delete — with one exception: Contributor can delete director access tokens. Beyond deletion it also lacks three specific rights: it cannot merge pipeline commits, edit content settings, or complete onboarding.

Admin

Full access — read, create, edit, and delete — across every resource.

Owner

Full access, identical to Admin at the permission level, plus account ownership.

note

Admin and Owner hold exactly the same permissions. The difference between them is not expressed as a permission at all: transferring account ownership and terminating the account are restricted to the Owner in code, and were deliberately removed from the grantable permission catalog so that no role can be given them.

warning

The built-in roles cannot be modified or deleted.

Role Permission Matrix

Every cell below is derived from the platform's role seed.

Symbol	Grants
R	Read
C	Create
E	Edit
D	Delete
M	Merge — pipeline commits only
S	Switch — MSSP tenants only
X	Complete — onboarding only
—	No access

Fleet Management

Resource	Key prefix	User	Contributor	Admin	Owner
Directors	DIRECTOR	R	R C E	R C E D	R C E D
Clusters	CLUSTER	R	R C E	R C E D	R C E D
Devices	DEVICE	R	R C E	R C E D	R C E D
Targets	TARGET	R	R C E	R C E D	R C E D
Datasets	DATASET	R	R C E	R C E D	R C E D
Profiles	PROFILE	R	R C E	R C E D	R C E D
Enrollment templates	ENROLLMENT_TEMPLATE	—	R C E	R C E D	R C E D
Director access tokens	ACCESSTOKEN	R	R C D	R C D	R C D
Proxies	PROXY	R	R C E	R C E D	R C E D
Update management	UPDATEMANAGEMENT	R	R E	R E	R E
Live data	LIVEDATA	—	R	R	R
Console logs	CONSOLELOG	—	R	R	R

Content Management

Resource	Key prefix	User	Contributor	Admin	Owner
Pipelines	PIPELINE	R	R C E	R C E D	R C E D
Pipeline commits	PIPELINE_COMMIT	—	C	C M	C M
Library	LIBRARY	R	R C E	R C E D	R C E D
Detections	DETECTION	R	R C E	R C E D	R C E D
Vault	VAULT	R	R C E	R C E D	R C E D
Content Hub	CONTENTHUB	R	R	R	R

Routes

Resource	Key prefix	User	Contributor	Admin	Owner
Quick routes	QUICKROUTE	R	R C E	R C E D	R C E D
Advanced routes	ADVANCEDROUTE	R	R C E	R C E D	R C E D

Deploy

Resource	Key prefix	User	Contributor	Admin	Owner
Deployments	DEPLOYMENT	R	R C	R C	R C

Monitoring and Analytics

Resource	Key prefix	User	Contributor	Admin	Owner
Alerts	ALERT	R	R E	R E	R E
Alert rules	ALERT_RULE	R	R C E	R C E D	R C E D
Rule actions	RULE_ACTION	R	R C E	R C E D	R C E D
Stats	STATS	—	R	R	R

Organization

Resource	Key prefix	User	Contributor	Admin	Owner
Users	USER	R	R C E	R C E D	R C E D
Roles	ROLE	R	R C E	R C E D	R C E D
Audit	AUDIT	R	R	R	R
Settings	SETTINGS	R	R E	R E	R E
Content settings	CONTENT_SETTINGS	—	—	E	E
SSO	SSO	R	R C E	R C E D	R C E D
MFA	MFA	—	R C E	R C E D	R C E D
API tokens	API_TOKEN	—	R C E	R C E D	R C E D
MSSP tenants	MSSP	R S	R C E S	R C E D S	R C E D S
Access requests	REQUESTACCESS	R	R C E	R C E	R C E
Usage	USAGE	R	R	R	R
Onboarding	ONBOARDING	—	—	X	X

V-Pilot

Permission	Grants	User	Contributor	Admin	Owner
ASSISTANT_USE	Open and use V-Pilot	Yes	Yes	Yes	Yes
ASSISTANT_SAMPLE_DATA	Let V-Pilot read raw log data: samples, pipeline test data, device logs, the audit log, and secrets' metadata	—	—	Yes	Yes

See V-Pilot: Access and Limits.

Rows worth noting:

• Audit, Content Hub, and Usage are read-only for every role, Owner included. AUDIT_READ is the only audit permission that exists, so there is no way to edit or delete audit records.
• Director access tokens are the one resource where Contributor, Admin, and Owner are identical, and the one place Contributor can delete. No role can edit a token — a token is replaced rather than changed.
• Alerts, Settings, and Update management have no create or delete: they are edited in place.
• Pipeline commits separate authoring from approval. Contributor can commit; only Admin and Owner can merge. See Source Control.
• Content settings is Admin and Owner only, and edit-only. See Content Settings.
• Access requests have no delete permission at all: the family is read, create, and edit only, for every role that holds it.
• Live data read also gates the Search page. The User role, which lacks it, cannot open Search.

Custom Roles

Enterprise

The built-in roles above are available on every plan. Listing the roles you already have is always available; creating, opening, cloning, editing, and deleting a role all require Advanced RBAC, and the role search box is disabled without it.

Creating a Custom Role

Click Create new role. The page heading reads Create a custom role.

1. Role details — a Role Name, a Description, and a Scope restricting where the role applies, which defaults to All.

2. Configuration method — Basic offers suggested roles assembled from common permission sets; Advanced exposes the permission sets individually, filtered with the View the actions for selector.

3. Review — a Summary panel on the right reflects the selections. Click Create Role to submit, or Cancel to discard.

Scopes and Their Permission Sets

The catalog a custom role is assembled from:

Scope	Permission sets it offers
Pipeline (PIPELINE)	PIPELINE_ADMIN, PIPELINE_CONTRIBUTOR, PIPELINE_VIEWER
Audit (AUDIT)	AUDIT_MANAGER
Roles (ROLES)	ROLE_ADMIN, ROLE_CONTRIBUTOR, ROLE_VIEWER
User (USER)	USER_ADMIN, USER_CONTRIBUTOR, USER_VIEWER
Fleet Management (FLEET_MANAGEMENT)	DIRECTOR_ADMIN, DIRECTOR_CONTRIBUTOR, DIRECTOR_VIEWER, CLUSTER_ADMIN, CLUSTER_CONTRIBUTOR, CLUSTER_VIEWER, DEVICE_ADMIN, DEVICE_CONTRIBUTOR, DEVICE_VIEWER, TARGET_ADMIN, TARGET_CONTRIBUTOR, TARGET_VIEWER
Content Hub (CONTENT_HUB)	CONTENT_HUB_ADMIN, CONTENT_HUB_CONTRIBUTOR, CONTENT_HUB_VIEWER
Routes (ROUTES)	QUICK_ROUTE_ADMIN, QUICK_ROUTE_CONTRIBUTOR, QUICK_ROUTE_VIEWER, ADVANCED_ROUTE_ADMIN, ADVANCED_ROUTE_CONTRIBUTOR, ADVANCED_ROUTE_VIEWER
Stats (STATS)	STATS_MANAGER, STATS_CONTRIBUTOR
MSSP (MSSP)	MSSP_ADMIN, MSSP_CONTRIBUTOR, MSSP_VIEWER
SSO (SSO)	SSO_ADMIN, SSO_CONTRIBUTOR, SSO_VIEWER
Settings (SETTINGS)	SETTINGS_MANAGER, SETTINGS_CONTRIBUTOR
Usage and Limits (USAGE_AND_LIMITS)	USAGE_AND_LIMITS_MANAGER
Token (TOKEN)	TOKEN_ADMIN
MFA (MFA)	MFA_ADMIN, MFA_CONTRIBUTOR
Dataset (DATASET)	DATASET_ADMIN, DATASET_CONTRIBUTOR, DATASET_VIEWER
Profile (PROFILE)	PROFILE_ADMIN, PROFILE_CONTRIBUTOR, PROFILE_VIEWER
Vault (VAULT)	VAULT_ADMIN, VAULT_CONTRIBUTOR
Library (LIBRARY)	LIBRARY_ADMIN, LIBRARY_CONTRIBUTOR, LIBRARY_VIEWER
Detection (DETECTION)	DETECTION_ADMIN, DETECTION_CONTRIBUTOR, DETECTION_VIEWER
Alert (ALERT)	ALERT_ADMIN, ALERT_CONTRIBUTOR, ALERT_VIEWER
Alert Rule (ALERT_RULE)	ALERT_RULE_ADMIN, ALERT_RULE_CONTRIBUTOR, ALERT_RULE_VIEWER
Enrollment (ENROLLMENT)	ENROLLMENT_TEMPLATE_ADMIN, ENROLLMENT_TEMPLATE_CONTRIBUTOR
API Token (API_TOKEN)	API_TOKEN_ADMIN, API_TOKEN_CONTRIBUTOR
Proxy (PROXY)	PROXY_ADMIN, PROXY_CONTRIBUTOR, PROXY_VIEWER
Health (HEALTH)	HEALTH
Deployment (DEPLOYMENT)	DEPLOYMENT_ADMIN, DEPLOYMENT_VIEWER

Most scopes offer three tiers: _VIEWER reads, _CONTRIBUTOR adds create and edit, _ADMIN adds delete. Where a scope offers fewer, its resource has no meaningful tier to add — AUDIT, TOKEN, USAGE_AND_LIMITS, and HEALTH carry a single set, and STATS, SETTINGS, MFA, VAULT, ENROLLMENT, API_TOKEN, and DEPLOYMENT carry two.

Deployment governs Deploy: DEPLOYMENT_VIEWER grants DEPLOYMENT_READ, and DEPLOYMENT_ADMIN adds DEPLOYMENT_CREATE, which runs and cancels deployments. Owner, Admin, and Contributor hold the Admin set; User holds the Viewer set. A deployment still needs each resource's own permissions for what it writes.

Two scopes cover more than one resource: Fleet Management offers separate tiers for directors, clusters, devices, and targets, and Routes offers separate tiers for quick routes and advanced routes.

Token and API Token are different things. TOKEN governs the access tokens a director enrolls with; API_TOKEN governs the organization's API tokens, managed under Organization > Settings > API Tokens.

Role Assignment

Roles are assigned to a user at account creation or afterwards from Organization > Users. The roles offered are filtered by your edition: a role holding permissions your edition does not include is not selectable.

Modifying and Deleting Roles

Open the role's Action menu (⋮).

• Manage role edits a custom role. Permission changes take effect immediately, and affected users' sessions are invalidated so the new permissions apply without a re-login. PowerShell and Cloud Shell sessions are the exception: a role change ends them, and the affected users sign in to PowerShell again.
• Clone role copies any role, built-in ones included, as the starting point for a custom one.
• Delete role removes a custom role after confirmation. If the role has assigned users, the confirmation lets you pick a replacement role, and the affected users are reassigned before the deletion completes.

Built-in roles cannot be deleted, and the Owner role is protected outright so that an organization cannot be locked out of its own account.