> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mirurobotics.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

export const GroupManagerBadge = ({size = "md"}) => {
  return <Tooltip tip="Members who are managers of a group that contains this resource can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="group" color="blue" size={size}>group manager</Badge>
        </Tooltip>;
};

export const PublisherBadge = ({size = "md"}) => {
  return <Tooltip tip="Members with the publisher role can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="git-merge" color="green" size={size}>publisher</Badge>
        </Tooltip>;
};

export const ProvisionerBadge = ({size = "md"}) => {
  return <Tooltip tip="Members with the provisioner role can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="bot" color="purple" size={size}>provisioner</Badge>
        </Tooltip>;
};

export const OperatorBadge = ({size = "md"}) => {
  return <Tooltip tip="Members with the operator role can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="wrench" color="orange" size={size}>operator</Badge>
        </Tooltip>;
};

export const ViewerBadge = ({size = "md"}) => {
  return <Tooltip tip="Members with the viewer role can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="eye" color="gray" size={size}>viewer</Badge>
        </Tooltip>;
};

export const MemberBadge = ({size = "md"}) => {
  return <Tooltip tip="Every workspace member can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="user" color="gray" size={size}>member</Badge>
        </Tooltip>;
};

export const AdminBadge = ({size = "md"}) => {
  return <Tooltip tip="Workspace owners and administrators can execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="shield-check" color="blue" size={size}>admin</Badge>
        </Tooltip>;
};

export const OwnerBadge = ({size = "md"}) => {
  return <Tooltip tip="You must be the owner to execute this action." cta="Workspace roles" href="/admin/users/access-control">
            <Badge icon="crown" color="yellow" size={size}>owner</Badge>
        </Tooltip>;
};

There are two access control mechanisms for users in a workspace:

1. **User types** — determine the broad access levels of a user
2. **Roles** — grant fine-grained access to the workspace

## User types

User types determine the broad access levels of a user. Below is a summary of the user types and their functions.

<OwnerBadge /> — complete control over the workspace; exactly one per workspace

<AdminBadge /> — complete administrative and application access; is subordinate to the owner

<MemberBadge /> — limited application access with no administrative privileges

Owners have unrestricted access to the workspace with the ability to execute any action.  Administrators hold nearly the same access as owners, but are unable to adjust the access controls of owners.

Members are the only user type that can be granted fine-grained access to the workspace through [roles](#roles). Since administrators and owners already have complete access to the workspace, they cannot be given any roles.

### Admin privileges

There are a variety of privileges which are only available to owners and administrators. Outside of the [group manager](#group-manager) role, no roles can grant any of these privileges.

[API Keys](/admin/apikeys)

* Create a new API key
* Delete an API key

[Config types](/cfg-mgmt/primitives/config-types)

* Delete a config type

[Groups](/primitives/groups)

* Create a group
* Update a group
* Delete a group
* Move a device to a different group

[Invites](/admin/users/invites)

* Send an invite
* Resend an invite
* Revoke an invite

[Members](/admin/users/manage)

* Suspend a member
* Update another member's role

[Releases](/primitives/releases)

* Delete a release

[Workspace](/admin/workspace)

* Update the workspace

## Roles

While a user's type determines broad access and administrative capabilities, **roles** grant fine-grained access to the workspace. Because owners and admins already have full access to the workspace, roles can only be granted to members.

A member's roles are defined in two independent sources:

* **Workspace roles** apply across the entire workspace
* **Group roles** apply to a [group](/primitives/groups) and all of its subgroups

A member can hold any combination of both. Permissions are always **additive** — Miru allows an action if any of the member's roles permit it, and one role never removes access granted by another.

### Workspace-only roles

Below are the roles which are only available at the workspace level. These roles cannot be assigned to users for a particular group.

#### Viewer  <ViewerBadge size="sm" />

Viewers hold read-only access to the entire application. It is not possible to restrict read access to specific groups or devices.

Viewer is the least privileged role there is. All roles implicitly include viewer access.

#### Publisher  <PublisherBadge size="sm" />

The publisher role allows members to create and edit config types, schemas, and releases (all the resources needed to publish a release). The publisher role grants access to the following operations:

[Config types](/cfg-mgmt/primitives/config-types)

* Create a config type
* Edit a config type

[Config schemas](/cfg-mgmt/primitives/schemas/manage)

* Create a config schema

[Buckets](/data-uploads/primitives/buckets)

* Connect a bucket
* Edit a bucket
* Delete a bucket
* Archive a bucket

[Upload collections](/data-uploads/primitives/upload-collections)

* Create an upload collection

[Upload rules](/data-uploads/primitives/upload-rules)

* Create an upload rule

[Releases](/primitives/releases)

* Create a release
* Duplicate a release

### Shared roles

Below are the roles which are available at both the workspace and group levels. These roles can be assigned to users for a particular group, as well as the entire workspace.

#### Operator  <OperatorBadge size="sm" />

The operator role allows members to deploy configurations to devices. The operator role grants access to the following operations:

[Config editor](/cfg-mgmt/deploy/config-editor)

* Deploy configurations to devices

[Release staging area](/cfg-mgmt/deploy/staging-area)

* Stage a deployment
* Patch a deployment
* Review a deployment
* Deploy a deployment
* Archive a deployment

#### Provisioner  <ProvisionerBadge size="sm" />

The provisioner role allows members to create and activate devices. The provisioner role grants access to the following operations:

[Manage devices](/primitives/devices)

* Create a device
* Edit a device
* Delete a device

[Provision devices](/cfg-mgmt/provision-devices/dashboard)

* Provision a device
* Reprovision a device

### Group-only roles

Below are the roles which are only available at the group level. These roles can only be assigned to users for a particular group, not for the entire workspace.

#### Group manager <GroupManagerBadge size="sm" />

The group manager role allows members to manage the members in a group, the members' grants, and the group's subgroups. It includes everything the operator and provisioner roles can do, along with the following operations:

[Groups](/primitives/groups)

* Create a subgroup
* Edit a group
* Move a device
* Delete a subgroup

[Devices](/primitives/devices)

* Move a device to a different group

[Members](/primitives/groups)

* Add a group member
* Edit group member permissions
* Remove group members