Permission reference
All permissions, what they allow and where they apply.
Use these tables to choose the access a member or team needs. Permissions explains how policies, scopes and inherited access work.
The names match the app. Each name also includes its permission code for use with the API. Sensitive matches the badge in the permission editor.
Scopes
A permission says what someone can do. Its scope says where they can do it.
| Scope | What it covers |
|---|---|
| Organization | The selected permissions apply throughout the organization, including to teams and agents created later. |
| Teams | The selected permissions apply only to the teams chosen in Applies to. They can cover team details, membership and team escalation policies. |
| Agents | The selected permissions apply only to the agents chosen in Applies to. They can cover agent details, instances, credentials and approval pipelines. |
The Scope column lists the choices for each permission. For example, Organization or Agents means you can allow that action across the organization or limit it to named agents.
Assigning a policy to a team gives its members access. Choosing Teams as the scope controls which teams that access covers.
Example: Editing one agent's pipeline
We'll give a member Edit approval pipelines with Agents scope and select Support assistant. This policy lets them edit that agent's pipeline. With Organization scope, the same permission covers the organization pipeline and every agent's pipeline.
Requests
These permissions use Organization scope. Permission to approve or deny applies to requests assigned to you or your team. See Review queue for reviewing requests.
| Permission | What it allows | Scope |
|---|---|---|
View requests (request.read) | Read requests and their outcomes. | Organization |
Claim requests (request.claim) | Claim a pending request while reviewing it. | Organization |
Approve or deny assigned requests (request.decide) | Approve or deny requests assigned to you or your team. | Organization |
Decide others’ requests (break glass) (request.decide.unrouted) | Sensitive. Decide requests assigned to other people. Also requires permission to approve or deny. | Organization |
View others’ requests (request.read.unrouted) | See every request whatever the request visibility policy says, including requests routed to other people. Owners and auditors hold it. | Organization |
Decisions outside routing explains emergency access and requests without an escalation path.
Permission policies
| Permission | What it allows | Scope |
|---|---|---|
View permission policies (permission_policy.read) | See policies and available permissions. | Organization, Teams or Agents |
Manage permission policies (permission_policy.write) | Sensitive. Grant, change and remove policies for members and teams. You can grant only access you already have. | Organization, Teams or Agents |
Teams
Teams scope covers existing teams. Creating a team requires Organization scope. See Team administration and team escalation policies.
| Permission | What it allows | Scope |
|---|---|---|
View teams (team.read) | View teams and their members. | Organization or Teams |
Manage teams (team.write) | Create, rename and archive teams. | Organization or Teams |
Manage team members (team.member.write) | Add or remove team members. | Organization or Teams |
Edit team escalation policies (team.escalation.write) | Save new revisions of a team's policy. | Organization or Teams |
Activate team escalation policies (team.escalation.activate) | Activate, roll back and archive team policies. | Organization or Teams |
Agents
Agents scope covers existing agents. Creating an agent requires Organization scope. See Agents for connections and credentials.
| Permission | What it allows | Scope |
|---|---|---|
View agents (agent.read) | View agents, their instances and credential status. | Organization or Agents |
Manage agents (agent.write) | Create, rename, enable, disable, archive and restore agents. | Organization or Agents |
Issue agent credentials (agent.credential.issue) | Sensitive. Issue instance credentials and provisioner tokens. | Organization or Agents |
Revoke agent credentials (agent.credential.revoke) | Revoke instance credentials and provisioner tokens. | Organization or Agents |
Approval pipelines
Agents scope covers the selected agents' pipelines. Managing the organization pipeline requires Organization scope. Editing and activation are separate permissions. See Approval pipelines.
| Permission | What it allows | Scope |
|---|---|---|
View approval pipelines (pipeline.read) | Read pipelines and their revision history. | Organization or Agents |
Edit approval pipelines (pipeline.write) | Save new revisions and test sample requests. | Organization or Agents |
Activate approval pipelines (pipeline.activate) | Activate revisions and roll back to earlier revisions. | Organization or Agents |
Escalation paths
Escalation paths are shared across the organization.
| Permission | What it allows | Scope |
|---|---|---|
View escalation paths (escalation_path.read) | Read paths and their revision history. | Organization |
Edit escalation paths (escalation_path.write) | Create paths and save new revisions. | Organization |
Activate escalation paths (escalation_path.activate) | Activate revisions, roll back and archive paths. | Organization |
Webhooks and MCP gateway
Webhook endpoints have one management permission for editing, activation and testing.
| Permission | What it allows | Scope |
|---|---|---|
View webhooks (webhook.read) | View endpoints and their revisions. | Organization |
Manage webhooks (webhook.write) | Create, edit, test, activate and archive endpoints, and rotate signing secrets. | Organization |
View MCP gateway (gateway.read) | View gateway servers and credential information. Hosted edition only. | Organization |
Configure MCP gateway (gateway.write) | Configure servers, tools that require approval and gateway credentials. Hosted edition only. | Organization |
Organization and members
| Permission | What it allows | Scope |
|---|---|---|
View organization settings (organization.read) | Read organization settings and policies. | Organization |
Edit organization settings (organization.settings.write) | Change organization settings and policies. | Organization |
Delete organization (organization.delete) | Sensitive. Schedule the organization for deletion. | Organization |
View members (membership.read) | View members and pending invitations. | Organization |
Invite members (membership.invite) | Invite people and manage pending invitations. | Organization |
Manage member status (membership.write) | Suspend, reactivate and remove members. | Organization |
Organization ownership gives full access and is managed separately from these permissions.
Connections and audit log
| Permission | What it allows | Scope |
|---|---|---|
View connections (connection.read) | View single sign-on, directory, chat and domain connections. | Organization |
Manage connections (connection.write) | Sensitive. Connect and disconnect identity providers, directories, chat apps and domains. | Organization |
View audit log (audit.read) | Read the Audit log. Hosted edition only. | Organization |
API keys
These permissions are available to people signing in to the app. API keys cannot carry them.
| Permission | What it allows | Scope |
|---|---|---|
Create personal API keys (api_key.issue) | Create personal API keys. | Organization |
Issue organization API keys (api_key.organization.issue) | Sensitive. Create organization API keys and edit their permission policies. Hosted edition only. | Organization |
View all API keys (api_key.read) | View every API key in the organization. | Organization |
Revoke any API key (api_key.revoke) | Revoke any API key in the organization. | Organization |
Billing
Billing permissions are available on hosted withHuman.
| Permission | What it allows | Scope |
|---|---|---|
View the plan, seats, and usage (billing.read) | View the organization's subscription and usage. | Organization |
Change the plan, adjust seats, and open the billing portal (billing.write) | Manage the subscription, seat count and billing details. | Organization |
Agent and gateway credentials
These permissions belong to credentials used by agents and the MCP gateway. They are not choices in member or team permission policies.
| Permission | What it allows | Used by |
|---|---|---|
Create requests (request.create) | Submit approval requests. | Agent instances |
Call MCP gateway tools (gateway.call) | Call tools through the MCP gateway. | Gateway credentials |
Agents can also read their own requests and outcomes using the View requests permission.