Roles & Permissions Reference#

Complete reference for the Reply CMP RBAC model — all roles, their permissions, assignment rules, caching behaviour, and security guarantees.

Permission Format#

All permissions in Reply CMP follow the pattern:

Module.Resource / Action

Examples:

  • FinOps.Cost / Read — read cost data in FinOps

  • Discovery.Resource / Read — read inventory, metadata, history, and graph data in Discovery

  • Onboarding.Connection / Delete — delete cloud connections

Built-in Roles#

Three built-in roles cover the most common access patterns:

Role

Scope

Summary

Owner

Tenant

Full access to all modules + RBAC management (assign/revoke roles)

Contributor

Tenant

Full access to all modules; cannot manage RBAC

Reader

Tenant

Read-only access to all modules

Module-specific Roles#

Module roles allow granular elevation for specific platform areas:

Role

Module

Permissions

Discovery Contributor

Discovery

Discovery.Resource / Read, Write, Delete; can also trigger Discovery operations where enabled

Discovery Reader

Discovery

Discovery.Resource / Read

FinOps Contributor

FinOps

FinOps.Cost / Read, Write; FinOps.FinOpsDashboard / Read, Write, Delete; FinOps.Budget / Read, Write, Delete; FinOps.Report / Read, Write, Delete; FinOps.Allocation / Read, Write, Delete

FinOps Reader

FinOps

All FinOps resources / Read only

Provisioning Contributor

Provisioning

Provisioning.Deployment / Read, Write, Apply, Delete; Provisioning.Resource / Read, Write, Delete; Provisioning.Catalog / Read (Module registry)

Provisioning Reader

Provisioning

Provisioning.Deployment / Read; Provisioning.Resource / Read; Provisioning.Catalog / Read (Module registry)

Policy Contributor

Automation

Automation.PolicyInstance / Read, Write, Delete

Policy Reader

Automation

Automation.PolicyInstance / Read

Monitoring Contributor

Monitoring

Monitoring.MonitoringDashboard / Read, Write; Monitoring.AlertRule / Read, Write, Delete

Monitoring Reader

Monitoring

Monitoring.MonitoringDashboard / Read; Monitoring.AlertRule / Read

Tenant Reader

Tenant

Onboarding.Tenant / Read

User Administrator

Users

Onboarding.User / Read, Write, Delete (limited by superset rule)

Authorization Administrator

Users

Onboarding.Authorization / Read, Write, Delete (limited by superset rule)

Webhook Contributor

Administration

Onboarding.Webhook / Read, Write, Delete

Webhook Reader

Administration

Onboarding.Webhook / Read

Permission Domains#

All permission domains in the platform:

Domain

Resources

Actions available

Discovery

Resource

Read, Write, Delete

FinOps

Cost, FinOpsDashboard, Budget, Report, Allocation

Read, Write, Delete

Provisioning

Deployment, Resource, Catalog (Module registry)

Read, Write, Delete; Deployment also has Apply

Automation

PolicyInstance

Read, Write, Delete

Monitoring

MonitoringDashboard, AlertRule

Read, Write, Delete

Onboarding

Tenant, Connection, User, Authorization, Webhook

Read, Write, Delete

AI Agent

Conversational access to platform data and supported actions

Same module permissions used by the UI

Special Permission Notes#

Permission

What it enables

Provisioning.Deployment / Apply

Apply a deployment plan and create, update, or destroy the cloud resources described by that deployment

Provisioning.Resource / Read

View provisioned resource details and state

Provisioning.Catalog / Read

Browse deployable catalog items

Onboarding.Authorization / Write

Assign or revoke user roles, subject to the superset rule

Onboarding.Webhook / Write

Create or update webhook, Teams, and PagerDuty notification channels

Onboarding.Tenant / Read

View tenant-level settings and quota usage

Onboarding.Tenant / Write

Update tenant-level settings, including quota increase requests where available

Assignment Rules#

Superset rule: You can only assign roles whose combined permissions are a subset of your own. This prevents privilege escalation through delegation.

  • A FinOps Reader cannot assign the FinOps Contributor role to another user.

  • A Contributor can assign any non-Owner role.

Self-operation prohibition: You cannot assign roles to yourself, nor revoke your own roles. This requires a second administrator.

Scope: Roles are tenant-scoped. A user’s roles apply to the entire tenant — there are no per-group or per-resource role assignments.

Multiple roles: A user can hold any number of roles simultaneously. Effective permissions are the union of all assigned roles.

Caching#

For performance, role assignments and effective permission sets are cached:

Cache

Duration

Notes

Role assignments

30 minutes (5-minute sliding window)

After assigning a new role, it may take up to 30 min to take effect

Role definitions

24 hours

Role definitions rarely change

Note

If you need a permission to take effect immediately (e.g., for a new user who needs urgent access), ask the user to log out and log back in — this invalidates their session cache.

CMP Agent Permissions#

The CMP Agent follows the same RBAC model as the UI. If a user cannot open a module or read a dataset in the UI, the Agent cannot access that data either.

Example: a Discovery-only user can ask inventory questions, but cannot ask for cost totals through the CMP Agent.

Discovery graph queries, type-specific properties, support level, and change history all require Discovery.Resource / Read. Triggering a Discovery sync from the CMP Agent requires Discovery.Resource / Write and explicit user confirmation.

Actions such as triggering Discovery, changing allocation groups, or toggling alert rules require write permissions and may ask for in-chat confirmation before execution.