> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zenable.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Roles and Permissions
> Control access with role-based permissions
## Overview
Zenable uses Role-Based Access Control (RBAC) to manage who can do what within your organization. The system follows these principles:
* **Permissions** are atomic actions (e.g., "edit requirements")
* **Roles** bundle permissions together (e.g., "Admin" has many permissions)
* **Users** are assigned roles directly or via identity provider groups
## Check your permissions from the CLI
Not sure whether you can do something? The [Zenable CLI](/integrations/zenable/commands?utm_source=docs\&utm_medium=web) answers it directly. `zenable auth can-i` prints `yes` or `no` (and sets a matching exit code, so it's scriptable) for any RBAC permission **or** MCP tool:
```bash Check a permission theme={null}
zenable auth can-i requirements:write
```
```bash Check an MCP tool theme={null}
zenable auth can-i get_findings
```
```bash List everything you can and cannot do theme={null}
zenable auth can-i --list
```
Every permission in the matrix below and every Zenable MCP tool is covered. `--list` shows them all at once with each one's grant status.
Don't have the CLI yet? See the [installation guide](/integrations/zenable/commands?utm_source=docs\&utm_medium=web#quick-installation).
## System Roles
Zenable provides six predefined roles that cover common access patterns:
| Role | Description | Key Capabilities |
| ------------------------- | ------------------------------------- | --------------------------------------------------------------------- |
| **Viewer** | Read-only access | View requirements, users, integrations, settings |
| **Contributor** | Create and edit content | All Viewer permissions + write/export requirements |
| **Admin** | Full admin access (billing read-only) | All Contributor + manage users, roles, integrations, audit logs |
| **Owner** | Complete access | All Admin + billing management |
| **Billing Administrator** | Financial access | View everything + manage billing and invoices |
| **Security Auditor** | Audit + governance access | View/export audit logs, view requirements, guardrails, and governance |
Custom roles are available on Enterprise plans. Contact us to learn more.
## Groups
Groups are tenant-owned sets of users, created and managed on the [Groups tab in Company Settings](https://www.zenable.app/settings?tab=groups\&utm_source=docs\&utm_medium=web). They are referenced by `GROUP` requirement scopes (see [`groups:read` / `groups:write`](#groups)).
A group can also contain other groups, so a scope on a parent group reaches members of its nested teams.
Group nesting is capped at 3 levels deep; members nested below that are not included.
## RBAC Audit Logging
RBAC Audit logging is available on **Professional** and **Enterprise** plans only. Log exporting requires an **Enterprise** plan.
All role and permission assignments and revocations are logged for compliance, including any provided reason.
Audit logs cannot be deleted by users regardless of role.
Access audit logs via the **Audit** section in the management console or through the `audit:read` permission.
## Role Permission Matrix
| Permission | Viewer | Contributor | Admin | Owner | Billing Admin | Security Auditor |
| ---------------------- | :----: | :---------: | :---: | :---: | :-----------: | :--------------: |
| requirements:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| requirements:write | | ✓ | ✓ | ✓ | | |
| requirements:delete | | | ✓ | ✓ | | |
| requirements:export | | ✓ | ✓ | ✓ | | |
| context:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| context:write | | ✓ | ✓ | ✓ | | |
| scopes:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| scopes:write | | ✓ | ✓ | ✓ | | |
| groups:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| groups:write | | ✓ | ✓ | ✓ | | |
| guardrails:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| guardrails:write | | ✓ | ✓ | ✓ | | |
| findings:read | ✓ | ✓ | ✓ | ✓ | | |
| findings:manage | | ✓ | ✓ | ✓ | | |
| reports:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| reports:write | | ✓ | ✓ | ✓ | | |
| users:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| users:invite | | | ✓ | ✓ | | |
| users:remove | | | ✓ | ✓ | | |
| users:manage | | | ✓ | ✓ | | |
| users:manage\_seats | | | ✓ | ✓ | | |
| roles:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| roles:manage | | | ✓ | ✓ | | |
| billing:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| billing:manage | | | | ✓ | ✓ | |
| billing:view\_invoices | | | | ✓ | ✓ | |
| audit:read | | | ✓ | ✓ | | ✓ |
| audit:export | | | ✓ | ✓ | | ✓ |
| governance:read | ✓ | ✓ | ✓ | ✓ | | ✓ |
| governance:manage | | | ✓ | ✓ | | |
| governance:delete | | | ✓ | ✓ | | |
| integrations:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| integrations:manage | | | ✓ | ✓ | | |
| settings:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| settings:manage | | | ✓ | ✓ | | |
| feature\_flags:read | | | ✓ | ✓ | | |
| feature\_flags:manage | | | ✓ | ✓ | | |
| marketplace:publish | | | | | | |
| requirements:approve | | ✓ | ✓ | ✓ | | |
| guardrails:approve | | ✓ | ✓ | ✓ | | |
| approvals:read | ✓ | ✓ | ✓ | ✓ | | |
| approvals:feedback | | ✓ | ✓ | ✓ | | |
| approvals:manage | | | ✓ | ✓ | | |
| feedback:read | | ✓ | ✓ | ✓ | | |
| feedback:write | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| company:manage | | | | ✓ | | |
## Permissions by Category
### Requirements
| Permission | Description |
| --------------------- | --------------------------------------------------------- |
| `requirements:read` | View and search requirements |
| `requirements:write` | Create and edit requirements |
| `requirements:delete` | Permanently delete requirements and associated guardrails |
| `requirements:export` | Export requirements to external formats |
Deleting a requirement is permanent and also deletes all guardrails associated with that requirement. This action cannot be undone.
### Context
| Permission | Description |
| --------------- | ---------------------------------------------------- |
| `context:read` | View reviewer contexts at customer and tenant levels |
| `context:write` | Create, edit, and delete reviewer contexts |
### Scopes
| Permission | Description | Minimum Tier |
| -------------- | ------------------------------------------ | ------------ |
| `scopes:read` | View scope definitions | Professional |
| `scopes:write` | Create, edit, and delete scope definitions | Professional |
### Groups
| Permission | Description | Minimum Tier |
| -------------- | -------------------------------------------------------- | ------------ |
| `groups:read` | View groups and their members | Professional |
| `groups:write` | Create, edit, and delete groups and manage their members | Professional |
Groups are tenant-owned sets of users referenced by `GROUP` requirement scopes. They are gated like scopes, since they're only useful via scoping.
### Guardrails
| Permission | Description | Minimum Tier |
| ------------------ | ----------------------------------- | ------------ |
| `guardrails:read` | View guardrails | Professional |
| `guardrails:write` | Create, edit, and delete guardrails | Professional |
### Findings
| Permission | Description | Minimum Tier |
| ----------------- | ----------------------------------------- | ------------ |
| `findings:read` | View code review findings and resolutions | Professional |
| `findings:manage` | Create, update, and resolve findings | Professional |
### Reports
| Permission | Description |
| --------------- | ------------------------- |
| `reports:read` | View assessment reports |
| `reports:write` | Upload assessment reports |
### Users
| Permission | Description |
| -------------------- | -------------------------------------------------------------------------------------------------- |
| `users:read` | View team members |
| `users:invite` | Invite new users |
| `users:remove` | Remove users from tenant |
| `users:manage` | Assign and revoke roles, and link third-party identities (e.g. GitHub or GitLab accounts) to users |
| `users:manage_seats` | Release and reassign seat licenses for users in tenant |
### Roles
| Permission | Description |
| -------------- | ------------------------------------------------------ |
| `roles:read` | View custom roles and their permissions |
| `roles:manage` | Create, edit, delete, promote, and demote custom roles |
### Billing
| Permission | Description |
| ----------------------- | ------------------------ |
| `billing:read` | View billing information |
| `billing:manage` | Modify subscription |
| `billing:view_invoices` | Download invoices |
### Audit
| Permission | Description | Minimum Tier |
| -------------- | ----------------- | ------------ |
| `audit:read` | View audit logs | Professional |
| `audit:export` | Export audit logs | Enterprise |
### Governance
| Permission | Description | Minimum Tier |
| ------------------- | --------------------------------------------------------------- | ------------ |
| `governance:read` | View governance domains and evidence | Professional |
| `governance:manage` | Create and edit governance domains and map requirements to them | Professional |
| `governance:delete` | Delete governance domains from the tenant taxonomy | Professional |
Deleting a governance domain is permanent. Requirements mapped to the domain must be reassigned or explicitly unmapped as part of the deletion flow.
### Integrations
| Permission | Description |
| --------------------- | ----------------------------------- |
| `integrations:read` | View configured integrations |
| `integrations:manage` | Add, remove, configure integrations |
### Settings
| Permission | Description |
| ----------------- | --------------------------- |
| `settings:read` | View tenant settings |
| `settings:manage` | Modify tenant configuration |
### Feature Flags
| Permission | Description |
| ---------------------- | ---------------------------- |
| `feature_flags:read` | View feature flags |
| `feature_flags:manage` | Enable/disable feature flags |
### Marketplace
| Permission | Description | Minimum Tier |
| --------------------- | ------------------------------------------------ | ------------ |
| `marketplace:publish` | Publish new versions of marketplace requirements | Enterprise |
### Approvals
| Permission | Description | Minimum Tier |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------ |
| `requirements:approve` | Cast a binding approve/reject decision on requirement proposals | Professional |
| `guardrails:approve` | Cast a binding approve/reject decision on guardrail regeneration requests | Professional |
| `approvals:read` | View approval flows, pending requests, and the full feedback thread (everything is transparent — no per-record hiding) | Professional |
| `approvals:feedback` | Submit non-binding feedback (vote up/down, add commentary) on an approval request | Professional |
| `approvals:manage` | Create, edit, and archive approval flow definitions and [approval policies](/approval-policies) | Professional |
Learn more about [approval workflows](https://docs.zenable.io/approval-workflows?utm_source=dashboard\&utm_medium=web).
### Feedback
| Permission | Description |
| ---------------- | --------------- |
| `feedback:read` | View feedback |
| `feedback:write` | Submit feedback |
### Company
| Permission | Description |
| ---------------- | ------------------------------------------------------------------------ |
| `company:manage` | Manage company-wide settings that apply across every tenant (owner only) |
**Need help?** Contact us at [hello@zenable.io](mailto:hello@zenable.io)