Permission reference
All permissions, what they allow and where they apply.
These tables list every permission, where it can apply and which roles hold it. Choosing individual permissions for a member, team or organization API key is part of the hosted edition. In the open edition, you give people one of the predefined roles. Permissions explains how roles, policies, scopes and inherited access work.
The names match the app. Each name also includes its permission code for use with the API. Sensitive matches the badge in the permission editor. Roles lists the predefined roles that hold the permission.
Scopes
A permission says what someone can do. Its scope says where they can do it. Predefined roles always apply to the whole organization; you choose a narrower scope in a custom permission policy.
| Scope | What it covers |
|---|---|
| Organization | The selected permissions apply throughout the organization, including to teams and agents created later. |
| Teams | The selected permissions apply only to the teams chosen in Applies to. They can cover team details, membership and team escalation policies. |
| Agents | The selected permissions apply only to the agents chosen in Applies to. They can cover agent details, instances and credentials. |
| Pipelines | The selected permissions apply only to the approval pipelines chosen in Applies to. |
The Scope column lists the choices for each permission. For example, Organization or Agents means you can allow that action across the organization or limit it to named agents.
Assigning a policy to a team gives its members access. Choosing Teams as the scope controls which teams that access covers.
Example: Letting a team edit one pipeline
On hosted withHuman, we'll give the support team View approval pipelines, Edit approval pipelines and Activate approval pipelines with Pipelines scope and select Support. The team can change the Support pipeline's rules, but not the entry pipeline or any other pipeline. With Organization scope, the same permissions cover every pipeline.
Requests
These permissions use Organization scope. Permission to approve or deny applies to requests assigned to you or your team. The Admin role holds none of them, so an admin can't view or decide requests. See Review queue for reviewing requests.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View requests (request.read) | Read requests and their outcomes. | Organization | Owner, Reviewer and Auditor |
Claim requests (request.claim) | Claim a pending request while reviewing it. | Organization | Owner and Reviewer |
Approve or deny assigned requests (request.decide) | Approve or deny requests assigned to you or your team. | Organization | Owner and Reviewer |
Decide others’ requests (break glass) (request.decide.unrouted) | Sensitive. Decide requests assigned to other people. Also requires permission to approve or deny. | Organization | Owner |
View others’ requests (request.read.unrouted) | See every request whatever the request visibility policy says, including requests routed to other people. | Organization | Owner and Auditor |
Decisions outside routing explains emergency access and requests without an escalation path.
Permission policies
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View permission policies (permission_policy.read) | See policies and available permissions. | Organization, Teams, Agents or Pipelines | Owner, Admin and Auditor |
Manage permission policies (permission_policy.write) | Sensitive. Grant, change and remove policies for members and teams. You can grant only access you already have. | Organization, Teams, Agents or Pipelines | Owner and Admin |
Teams
Teams scope covers existing teams. Creating a team requires Organization scope. See Team administration and team escalation policies.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View teams (team.read) | View teams and their members. | Organization or Teams | All roles |
Manage teams (team.write) | Create, rename and archive teams. | Organization or Teams | Owner and Admin |
Manage team members (team.member.write) | Add or remove team members. | Organization or Teams | Owner and Admin |
Edit team escalation policies (team.escalation.write) | Save new revisions of a team's policy. | Organization or Teams | Owner and Admin |
Activate team escalation policies (team.escalation.activate) | Activate, roll back and archive team policies. | Organization or Teams | Owner and Admin |
Agents
Agents scope covers existing agents. Creating an agent requires Organization scope. See Agents for connections and credentials.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View agents (agent.read) | View agents, their instances and credential status. | Organization or Agents | All roles |
Manage agents (agent.write) | Create, rename, enable, disable, archive and restore agents, and rename their instances. | Organization or Agents | Owner and Admin |
Issue agent credentials (agent.credential.issue) | Sensitive. Issue instance credentials and provisioner tokens for service agents. Members connect their own instances of personal agents without it. | Organization or Agents | Owner and Admin |
Revoke agent credentials (agent.credential.revoke) | Revoke instance credentials and provisioner tokens. | Organization or Agents | Owner and Admin |
Approval pipelines
Pipelines scope covers the selected pipelines, which can include the entry pipeline. Creating a pipeline requires Organization scope. Editing and activation are separate permissions. See Approval pipelines.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View approval pipelines (pipeline.read) | Read pipelines and their revision history. | Organization or Pipelines | Owner and Admin |
Edit approval pipelines (pipeline.write) | Save new revisions and test sample requests. With Organization scope, also create pipelines. | Organization or Pipelines | Owner and Admin |
Activate approval pipelines (pipeline.activate) | Activate revisions, roll back to earlier revisions and archive pipelines. | Organization or Pipelines | Owner and Admin |
Escalation paths
Escalation paths are shared across the organization.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View escalation paths (escalation_path.read) | Read paths and their revision history. | Organization | Owner and Admin |
Edit escalation paths (escalation_path.write) | Create paths and save new revisions. | Organization | Owner and Admin |
Activate escalation paths (escalation_path.activate) | Activate revisions, roll back and archive paths. | Organization | Owner and Admin |
Webhooks and MCP gateway
Webhook endpoints have one management permission for editing, activation and testing.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View webhooks (webhook.read) | View endpoints and their revisions. | Organization | Owner and Admin |
Manage webhooks (webhook.write) | Create, edit, test, activate and archive endpoints, and rotate signing secrets. | Organization | Owner and Admin |
View MCP gateway (gateway.read) | View gateway servers and credential information. Hosted edition only. | Organization | Owner and Admin |
Configure MCP gateway (gateway.write) | Configure servers, tools that require approval and gateway credentials. Hosted edition only. | Organization | Owner and Admin |
Organization and members
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View organization settings (organization.read) | Read organization settings and policies. | Organization | All roles |
Edit organization settings (organization.settings.write) | Change organization settings and policies. | Organization | Owner and Admin |
Delete organization (organization.delete) | Sensitive. Schedule the organization for deletion. | Organization | Owner |
View members (membership.read) | View members and pending invitations. | Organization | Owner and Admin |
Invite members (membership.invite) | Invite people and manage pending invitations. | Organization | Owner and Admin |
Manage member status (membership.write) | Suspend, reactivate and remove members. | Organization | Owner and Admin |
The Owner role holds every permission on this page.
Connections and audit log
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View connections (connection.read) | View single sign-on, directory, chat and domain connections. | Organization | Owner and Admin |
Manage connections (connection.write) | Sensitive. Connect and disconnect identity providers, directories, chat apps and domains. | Organization | Owner and Admin |
View audit log (audit.read) | Read the Audit log. Hosted edition only. | Organization | Owner, Admin and Auditor |
API keys
These permissions are available to people signing in to the app. API keys cannot carry them.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
Create personal API keys (api_key.issue) | Create personal API keys. | Organization | All roles |
Issue organization API keys (api_key.organization.issue) | Sensitive. Create organization API keys and edit their permission policies. Hosted edition only. | Organization | Owner and Admin |
View all API keys (api_key.read) | View every API key in the organization. | Organization | Owner, Admin and Auditor |
Revoke any API key (api_key.revoke) | Revoke any API key in the organization. | Organization | Owner and Admin |
Billing
Billing permissions are available on hosted withHuman.
| Permission | What it allows | Scope | Roles |
|---|---|---|---|
View the plan, seats, and usage (billing.read) | View the organization's subscription and usage. | Organization | Owner |
Change the plan, adjust seats, and open the billing portal (billing.write) | Manage the subscription, seat count and billing details. | Organization | Owner |
Agent and gateway credentials
These permissions belong to credentials used by agents and the MCP gateway. They are not choices in member or team permission policies.
| Permission | What it allows | Used by |
|---|---|---|
Create requests (request.create) | Submit approval requests. | Agent instances |
Call MCP gateway tools (gateway.call) | Call tools through the MCP gateway. | Gateway credentials |
Agents can also read their own requests and outcomes using the View requests permission.