Citadel DocsPermissions
Understand Citadel Roles, resource permissions, specific permissions, and overrides.
Citadel evaluates access through the current actor, assigned Roles and Teams, resource-level access, and explicit overrides. A visible UI control is not the authorization boundary; the API evaluates permissions again.
Use Access > Roles to view the permission matrix for the running instance. It is the authoritative list because Citadel adds resource types and specific operations as features are implemented.
Levels and capabilities
| Level | What it grants |
|---|---|
| None | No grant from this entry. Other assignments can still grant access. |
| Read | Read operations, subject to any additional capability required. |
| Write | Read plus configuration operations. |
| Execute | Read and Write plus execution operations, which can include deletion. |
Capabilities such as Logs, Terminal, Apply, and Restore are additional checks. A higher level does not automatically select every capability. Requirements differ by resource; for example, applying a Deployment and applying a Stack use different base levels.
| Operation | Requirement on the named resource |
|---|---|
| Read Stack or Deployment logs | Read + Logs |
| Open a Stack or Deployment terminal | Read + Terminal |
| Edit Stack or Deployment bindings | Write + Resource Bindings |
| Deploy a Deployment | Read + Apply |
| Deploy or roll back a Stack | Execute + Apply |
| View Stack releases | Read + Releases |
| Delete a Stack or Deployment | Execute |
| Restore a Backup Policy snapshot | Execute + Restore |
Dependent-resource access, resource state, and license capabilities can impose further requirements. Use the running instance's matrix and action explanation when diagnosing a denial.
Permission scope
Role permissions apply to a resource type and are granted directly or through an enabled Team. Resource overrides apply only to the existing resource selected in the grant.
Creating a resource requires global Write permission for its type. Write access granted only through an override permits editing that resource, but does not permit creating others. For example, a Backup Repository override does not grant permission to create repositories or policies; creating a policy requires global Backup Policy Write permission and access to its dependencies.
Backup API capabilities
The /api/v1/backupPolicies and /api/v1/backupRepositories list responses
report permissions at two scopes:
- Top-level
capabilitiesdescribe global permissions for that resource type. The UI usescanWritehere to enable Add Policy or Add Repository, respectively. - Each resource's
capabilitiesdescribe effective permissions for that resource, including applicable overrides.
A response can therefore have top-level canWrite: false while an individual
resource has canWrite: true. This means the user can edit that resource but
cannot create a new one. Top-level capabilities are not a summary of permissions
on the returned resources.
Updating S3 repository credentials requires Write and Execute on the repository, plus Read on Bindings to select stored secrets. Validation through a Platform also requires Execute on that Platform. Name and description edits continue to require only repository Write.
Additive access
Citadel combines direct Roles, enabled Team grants, and resource-specific access. An override grants access; it cannot deny access inherited elsewhere. Reducing one entry to None does not remove another Role's grant. To restrict a person, review all sources of access, including Admin assignments.
Follow the single-resource access example and test using the affected account, including an unrelated resource that should remain inaccessible.
Service Accounts use the same authorization model as users but cannot use an interactive browser session. Avoid the built-in Admin Role for integrations; create a dedicated Role containing only the required resource and operation permissions.