Permissions Reference

This page lists all configurable permission items in Role Details for your reference when configuring roles.

Roles contain two types of permissions:

• UI permissions: Control which navigation menus users can see (toggle switches)
• Resource permissions: Control the operation level users have on each business resource (No Access / Read-Only Access / Full Access)

Quick Reference: Permissions Required by Feature Module

The following table summarizes the UI permissions and resource permissions required for each feature module, making it easy to quickly look up "what permissions need to be enabled to use a particular module" when configuring a role.

How to Use This Table

1. Find the target feature module in the table below
2. Note the UI permission items and resource permission items it requires
3. Go to Role Details → UI Permissions tab and enable the corresponding menu toggles
4. Go to Role Details → Resource Permissions tab and set the corresponding resources to the required access level

General Features

Feature Module	Required UI Permissions	Required Resource Permissions	Notes
User Management	User Management	Users
User Group Management	User Group Management	User Groups
Role Management	Role Management	Roles
General Settings	General Settings	General Settings
Dashboard	Dashboard	Dashboards, Dashboard Groups	Dashboard Groups control group management capabilities
Collie (AI Assistant)	Collie	Uses existing permissions of each resource	Collie is subject to each resource's existing permissions when accessing business resources
Load Sample Data	Load Sample Data	Configuration Items full access, Queries full access
API Documentation	API Documentation	—	Controls menu visibility only; no corresponding resource permission
License Management	License Management	—	Controls menu visibility only; no corresponding resource permission

Discovery & Collection

Feature Module	Required UI Permissions	Required Resource Permissions	Notes
Collection Region	Collection Region	Collection Region
Collection Point Rules	Collection Point Rules	Collection Point Rules
Collection Points	Collection Points	Collection Points, Collection Point Groups	Collection Point Groups control group management capabilities
Collection Templates	Collection Templates	Collection Templates, Collection Template Groups	Collection Template Groups control group management capabilities

CMDB Features

Feature Module	Required UI Permissions	Required Resource Permissions	Notes
CI Catalog	CI Catalog	Configuration Items, CI Types, CI Relationships	CI Types and CI Relationships only require minimum read-only access; no separate authorization needed by default
CI List	CI List	Configuration Items, CI Types
CI Topology View	CI Topology View	Configuration Items, Queries, Query Groups
CI Types	CI Types	CI Types
CI Relationship Types	CI Relationship Types	CI Relationship Types
Option Lists	Option Lists	Option Lists
Query Studio	Query Studio	Queries, Query Groups	Query Groups control query group management capabilities

About the "Notes" Column

• — (No resource permission): This module controls menu visibility only through UI permissions and does not involve resource-level operations; no configuration is needed in the Resource Permissions tab.
• Multiple resource permissions: Some modules depend on both a primary resource and a grouping resource (e.g., "Collection Points" depends on "Collection Points" + "Collection Point Groups"). Both need to be authorized simultaneously to use the full group management features.

UI Permission Items

UI permissions are divided into three groups by feature module: General Features, Discovery & Collection, and CMDB Features. Enabling an item means that menu is visible to users with this role.

info

The global toolbar and global search are always visible and are not controlled by UI permissions.

General Features

Permission Item	Corresponding Menu
User Management	User Management
User Group Management	User Group Management
Role Management	Role Management
General Settings	General Settings
Load Sample Data	Load Sample Data
API Documentation	API Documentation
Dashboard	Dashboard
AI Assistant	AI Assistant
License Management	License Management
Collie (AI Assistant)	Collie

Discovery & Collection

Permission Item	Corresponding Menu
Collection Region	Collection Region
Collection Point Rules	Collection Point Rules
Collection Points	Collection Points
Collection Templates	Collection Templates

CMDB Features

Permission Item	Corresponding Menu
CI Catalog	CI Catalog
CI List	CI List
CI Topology View	CI Topology View
CI Types	CI Types
CI Relationship Types	CI Relationship Types
Option Lists	Option Lists
Query Studio	Query Studio

Resource Permission Items

Resource permissions are divided into three groups by category. Each resource can be set to No Access / Read-Only Access / Full Access.

Access Level Descriptions

Level	Meaning
No Access	No permission; cannot view or operate
Read-Only Access	Can view; cannot create/modify/delete
Full Access	Can view, and can also create/modify/delete

Required Resources

Some resources are fundamental to the platform's normal operation. The system marks them as required resources — regardless of how the role is configured, these resources always retain minimum read-only access. When configuring these resources on the Role Details page, the dropdown only offers "Read-Only Access" and "Full Access."

Required resources include:

• General Settings
• CI Types
• CI Relationship Types
• Option Lists
• Configuration Items

General Resources

Resource	Description
Users	Platform login accounts
User Groups	Collections of users
Roles	Permission collections
General Settings	System general settings — Required resource
Dashboards	Visualization dashboards
Dashboard Groups	Dashboard groups

Discovery & Collection

Resource	Description
Collection Templates	Collection task templates
Collection Template Groups	Groups for collection templates
Collection Points	Collection target objects
Collection Point Groups	Groups for collection points
Collection Regions	Collection region divisions
Collection Point Rules	Collection point matching rules

CMDB Resources

Resource	Description
CI Types	CI type definitions — Required resource
CI Relationship Types	CI relationship type definitions — Required resource
Option Lists	Enum option management — Required resource
Configuration Items	CI instance data — Required resource
Queries	Custom queries
Query Groups	Query groups

Built-in Role Permissions

The system's two out-of-the-box built-in roles have preset permissions that cannot be modified. They serve as reference baselines for custom roles.

administrator (Administrator)

• UI permissions: All menus are visible
• Resource permissions: All resources are set to Full Access

viewer (Read-Only User)

• UI permissions: All menus are visible except Load Sample Data, API Documentation, and License Management
• Resource permissions: All resources are set to Read-Only Access

Configuration Recommendations

Role Profile	UI Permissions	Resource Permissions
View-only personnel (audit/reporting)	Check only the menus they need to view	Set corresponding resources to Read-Only Access
Daily maintenance personnel	Check menus within their scope of responsibility	Set maintained objects to Full Access; others to Read-Only or No Access
Specialized administrator (e.g., CMDB only)	Check only CMDB-related menus	CMDB resources to Full Access; other resources to No Access
Restricted users	Check only essential menus	Set only essential resources to Read-Only; others to No Access

Principle of Least Privilege

When creating a new role, first check only the essential menus and resources. After running for a while, gradually expand as needed. It is better to start strict and loosen later rather than granting too much permission from the start.