Roles and Permissions

Overview

Zenable uses Role-Based Access Control (RBAC) to manage who can do what within your organization. The system follows these principles:

Permissions are atomic actions (e.g., “edit requirements”)
Roles bundle permissions together (e.g., “Admin” has many permissions)
Users are assigned roles directly or via identity provider groups

Check your permissions from the CLI

Not sure whether you can do something? The Zenable CLI answers it directly. zenable auth can-i prints yes or no (and sets a matching exit code, so it’s scriptable) for any RBAC permission or MCP tool:

zenable auth can-i requirements:write

zenable auth can-i get_findings

zenable auth can-i --list

Every permission in the matrix below and every Zenable MCP tool is covered. --list shows them all at once with each one’s grant status.

Don’t have the CLI yet? See the installation guide.

System Roles

Zenable provides six predefined roles that cover common access patterns:

Role	Description	Key Capabilities
Viewer	Read-only access	View requirements, users, integrations, settings
Contributor	Create and edit content	All Viewer permissions + write/export requirements
Admin	Full admin access (billing read-only)	All Contributor + manage users, roles, integrations, audit logs
Owner	Complete access	All Admin + billing management
Billing Administrator	Financial access	View everything + manage billing and invoices
Security Auditor	Audit + governance access	View/export audit logs, view requirements, guardrails, and governance

Custom roles are available on Enterprise plans. Contact us to learn more.

Groups

Groups are tenant-owned sets of users, created and managed on the Groups tab in Company Settings. They are referenced by GROUP requirement scopes (see groups:read / groups:write). A group can also contain other groups, so a scope on a parent group reaches members of its nested teams.

Group nesting is capped at 3 levels deep; members nested below that are not included.

RBAC Audit Logging

RBAC Audit logging is available on Professional and Enterprise plans only. Log exporting requires an Enterprise plan.

All role and permission assignments and revocations are logged for compliance, including any provided reason. Audit logs cannot be deleted by users regardless of role. Access audit logs via the Audit section in the management console or through the audit:read permission.

Role Permission Matrix

Permission	Viewer	Contributor	Admin	Owner	Billing Admin	Security Auditor
requirements:read	✓	✓	✓	✓	✓	✓
requirements:write		✓	✓	✓
requirements:delete			✓	✓
requirements:export		✓	✓	✓
context:read	✓	✓	✓	✓	✓
context:write		✓	✓	✓
scopes:read	✓	✓	✓	✓	✓
scopes:write		✓	✓	✓
groups:read	✓	✓	✓	✓	✓
groups:write		✓	✓	✓
guardrails:read	✓	✓	✓	✓	✓	✓
guardrails:write		✓	✓	✓
findings:read	✓	✓	✓	✓
findings:manage		✓	✓	✓
reports:read	✓	✓	✓	✓	✓	✓
reports:write		✓	✓	✓
users:read	✓	✓	✓	✓	✓
users:invite			✓	✓
users:remove			✓	✓
users:manage			✓	✓
users:manage_seats			✓	✓
roles:read	✓	✓	✓	✓	✓	✓
roles:manage			✓	✓
billing:read	✓	✓	✓	✓	✓
billing:manage				✓	✓
billing:view_invoices				✓	✓
audit:read			✓	✓		✓
audit:export			✓	✓		✓
governance:read	✓	✓	✓	✓		✓
governance:manage			✓	✓
governance:delete			✓	✓
integrations:read	✓	✓	✓	✓	✓
integrations:manage			✓	✓
settings:read	✓	✓	✓	✓	✓
settings:manage			✓	✓
feature_flags:read			✓	✓
feature_flags:manage			✓	✓
marketplace:publish
requirements:approve		✓	✓	✓
guardrails:approve		✓	✓	✓
approvals:read	✓	✓	✓	✓
approvals:feedback		✓	✓	✓
approvals:manage			✓	✓
feedback:read		✓	✓	✓
feedback:write	✓	✓	✓	✓	✓	✓
company:manage				✓

Permissions by Category

Requirements

Permission	Description
`requirements:read`	View and search requirements
`requirements:write`	Create and edit requirements
`requirements:delete`	Permanently delete requirements and associated guardrails
`requirements:export`	Export requirements to external formats

Deleting a requirement is permanent and also deletes all guardrails associated with that requirement. This action cannot be undone.

Context

Permission	Description
`context:read`	View reviewer contexts at customer and tenant levels
`context:write`	Create, edit, and delete reviewer contexts

Scopes

Permission	Description	Minimum Tier
`scopes:read`	View scope definitions	Professional
`scopes:write`	Create, edit, and delete scope definitions	Professional

Groups

Permission	Description	Minimum Tier
`groups:read`	View groups and their members	Professional
`groups:write`	Create, edit, and delete groups and manage their members	Professional

Groups are tenant-owned sets of users referenced by GROUP requirement scopes. They are gated like scopes, since they’re only useful via scoping.

Guardrails

Permission	Description	Minimum Tier
`guardrails:read`	View guardrails	Professional
`guardrails:write`	Create, edit, and delete guardrails	Professional

Findings

Permission	Description	Minimum Tier
`findings:read`	View code review findings and resolutions	Professional
`findings:manage`	Create, update, and resolve findings	Professional

Reports

Permission	Description
`reports:read`	View assessment reports
`reports:write`	Upload assessment reports

Users

Permission	Description
`users:read`	View team members
`users:invite`	Invite new users
`users:remove`	Remove users from tenant
`users:manage`	Assign and revoke roles, and link third-party identities (e.g. GitHub or GitLab accounts) to users
`users:manage_seats`	Release and reassign seat licenses for users in tenant

Roles

Permission	Description
`roles:read`	View custom roles and their permissions
`roles:manage`	Create, edit, delete, promote, and demote custom roles

Billing

Permission	Description
`billing:read`	View billing information
`billing:manage`	Modify subscription
`billing:view_invoices`	Download invoices

Audit

Permission	Description	Minimum Tier
`audit:read`	View audit logs	Professional
`audit:export`	Export audit logs	Enterprise

Governance

Permission	Description	Minimum Tier
`governance:read`	View governance domains and evidence	Professional
`governance:manage`	Create and edit governance domains and map requirements to them	Professional
`governance:delete`	Delete governance domains from the tenant taxonomy	Professional

Deleting a governance domain is permanent. Requirements mapped to the domain must be reassigned or explicitly unmapped as part of the deletion flow.

Integrations

Permission	Description
`integrations:read`	View configured integrations
`integrations:manage`	Add, remove, configure integrations

Settings

Permission	Description
`settings:read`	View tenant settings
`settings:manage`	Modify tenant configuration

Feature Flags

Permission	Description
`feature_flags:read`	View feature flags
`feature_flags:manage`	Enable/disable feature flags

Marketplace

Permission	Description	Minimum Tier
`marketplace:publish`	Publish new versions of marketplace requirements	Enterprise

Approvals

Permission	Description	Minimum Tier
`requirements:approve`	Cast a binding approve/reject decision on requirement proposals	Professional
`guardrails:approve`	Cast a binding approve/reject decision on guardrail regeneration requests	Professional
`approvals:read`	View approval flows, pending requests, and the full feedback thread (everything is transparent — no per-record hiding)	Professional
`approvals:feedback`	Submit non-binding feedback (vote up/down, add commentary) on an approval request	Professional
`approvals:manage`	Create, edit, and archive approval flow definitions and approval policies	Professional

Learn more about approval workflows.

Feedback

Permission	Description
`feedback:read`	View feedback
`feedback:write`	Submit feedback

Company

Permission	Description
`company:manage`	Manage company-wide settings that apply across every tenant (owner only)

Need help? Contact us at hello@zenable.io

Overview

Integrations

MCP Server

Guardrails Engines

IDE Installation Guides

Deprecated IDEs

Tools & Reference

Use Cases

Overview

Check your permissions from the CLI

System Roles

Groups

RBAC Audit Logging

Role Permission Matrix

Permissions by Category

Requirements

Context

Scopes

Groups

Guardrails

Findings

Reports

Users

Roles

Billing

Audit

Governance

Integrations

Settings

Feature Flags

Marketplace

Approvals

Feedback

Company

​Overview

​Check your permissions from the CLI

​System Roles

​Groups

​RBAC Audit Logging

​Role Permission Matrix

​Permissions by Category

​Requirements

​Context

​Scopes

​Groups

​Guardrails

​Findings

​Reports

​Users

​Roles

​Billing

​Audit

​Governance

​Integrations

​Settings

​Feature Flags

​Marketplace

​Approvals

​Feedback

​Company

Overview

Check your permissions from the CLI

System Roles

Groups

RBAC Audit Logging

Role Permission Matrix

Permissions by Category

Requirements

Context

Scopes

Groups

Guardrails

Findings

Reports

Users

Roles

Billing

Audit

Governance

Integrations

Settings

Feature Flags

Marketplace

Approvals

Feedback

Company