# Permission reference

All permissions, what they allow and where they apply.

Use these tables to choose the access a member or team needs. [Permissions](/docs/web-app/permissions) explains how policies, scopes and inherited access work.

The names match the app. Each name also includes its permission code for use with the API. **Sensitive** matches the badge in the permission editor.

## Scopes

A permission says **what** someone can do. Its scope says **where** they can do it.

| Scope | What it covers |
| --- | --- |
| **Organization** | The selected permissions apply throughout the organization, including to teams and agents created later. |
| **Teams** | The selected permissions apply only to the teams chosen in **Applies to**. They can cover team details, membership and team escalation policies. |
| **Agents** | The selected permissions apply only to the agents chosen in **Applies to**. They can cover agent details, instances, credentials and approval pipelines. |

The **Scope** column lists the choices for each permission. For example, **Organization or Agents** means you can allow that action across the organization or limit it to named agents.

Assigning a policy to a team gives its members access. Choosing Teams as the scope controls which teams that access covers.

### Example: Editing one agent's pipeline

We'll give a member **Edit approval pipelines** with **Agents** scope and select **Support assistant**. This policy lets them edit that agent's pipeline. With **Organization** scope, the same permission covers the organization pipeline and every agent's pipeline.

## Requests

These permissions use Organization scope. Permission to approve or deny applies to requests assigned to you or your team. See [Review queue](/docs/web-app/review-queue) for reviewing requests.

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View requests** (`request.read`) | Read requests and their outcomes. | Organization |
| **Claim requests** (`request.claim`) | Claim a pending request while reviewing it. | Organization |
| **Approve or deny assigned requests** (`request.decide`) | Approve or deny requests assigned to you or your team. | Organization |
| **Decide others’ requests (break glass)** (`request.decide.unrouted`) | **Sensitive.** Decide requests assigned to other people. Also requires permission to approve or deny. | Organization |
| **View others’ requests** (`request.read.unrouted`) | See every request whatever the [request visibility](/docs/web-app/organization-policies#request-visibility) policy says, including requests routed to other people. Owners and auditors hold it. | Organization |

[Decisions outside routing](/docs/web-app/permissions#decisions-outside-routing) explains emergency access and requests without an escalation path.

## Permission policies

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View permission policies** (`permission_policy.read`) | See policies and available permissions. | Organization, Teams or Agents |
| **Manage permission policies** (`permission_policy.write`) | **Sensitive.** Grant, change and remove policies for members and teams. You can grant only access you already have. | Organization, Teams or Agents |

## Teams

Teams scope covers existing teams. Creating a team requires Organization scope. See [Team administration](/docs/web-app/team-administration) and [team escalation policies](/docs/web-app/teams).

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View teams** (`team.read`) | View teams and their members. | Organization or Teams |
| **Manage teams** (`team.write`) | Create, rename and archive teams. | Organization or Teams |
| **Manage team members** (`team.member.write`) | Add or remove team members. | Organization or Teams |
| **Edit team escalation policies** (`team.escalation.write`) | Save new revisions of a team's policy. | Organization or Teams |
| **Activate team escalation policies** (`team.escalation.activate`) | Activate, roll back and archive team policies. | Organization or Teams |

## Agents

Agents scope covers existing agents. Creating an agent requires Organization scope. See [Agents](/docs/web-app/agents) for connections and credentials.

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View agents** (`agent.read`) | View agents, their instances and credential status. | Organization or Agents |
| **Manage agents** (`agent.write`) | Create, rename, enable, disable, archive and restore agents, and rename their instances. | Organization or Agents |
| **Issue agent credentials** (`agent.credential.issue`) | **Sensitive.** Issue instance credentials and provisioner tokens. | Organization or Agents |
| **Revoke agent credentials** (`agent.credential.revoke`) | Revoke instance credentials and provisioner tokens. | Organization or Agents |

## Approval pipelines

Agents scope covers the selected agents' pipelines. Managing the organization pipeline requires Organization scope. Editing and activation are separate permissions. See [Approval pipelines](/docs/web-app/approval-pipelines).

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View approval pipelines** (`pipeline.read`) | Read pipelines and their revision history. | Organization or Agents |
| **Edit approval pipelines** (`pipeline.write`) | Save new revisions and test sample requests. | Organization or Agents |
| **Activate approval pipelines** (`pipeline.activate`) | Activate revisions and roll back to earlier revisions. | Organization or Agents |

## Escalation paths

[Escalation paths](/docs/web-app/escalation-paths) are shared across the organization.

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View escalation paths** (`escalation_path.read`) | Read paths and their revision history. | Organization |
| **Edit escalation paths** (`escalation_path.write`) | Create paths and save new revisions. | Organization |
| **Activate escalation paths** (`escalation_path.activate`) | Activate revisions, roll back and archive paths. | Organization |

## Webhooks and MCP gateway

[Webhook endpoints](/docs/web-app/webhook-endpoints) have one management permission for editing, activation and testing.

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View webhooks** (`webhook.read`) | View endpoints and their revisions. | Organization |
| **Manage webhooks** (`webhook.write`) | Create, edit, test, activate and archive endpoints, and rotate signing secrets. | Organization |
| **View MCP gateway** (`gateway.read`) | View gateway servers and credential information. Hosted edition only. | Organization |
| **Configure MCP gateway** (`gateway.write`) | Configure servers, tools that require approval and gateway credentials. Hosted edition only. | Organization |

## Organization and members

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View organization settings** (`organization.read`) | Read organization settings and policies. | Organization |
| **Edit organization settings** (`organization.settings.write`) | Change organization settings and policies. | Organization |
| **Delete organization** (`organization.delete`) | **Sensitive.** Schedule the organization for deletion. | Organization |
| **View members** (`membership.read`) | View members and pending invitations. | Organization |
| **Invite members** (`membership.invite`) | Invite people and manage pending invitations. | Organization |
| **Manage member status** (`membership.write`) | Suspend, reactivate and remove members. | Organization |

[Organization ownership](/docs/web-app/permissions#organization-ownership) gives full access and is managed separately from these permissions.

## Connections and audit log

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View connections** (`connection.read`) | View single sign-on, directory, chat and domain connections. | Organization |
| **Manage connections** (`connection.write`) | **Sensitive.** Connect and disconnect identity providers, directories, chat apps and domains. | Organization |
| **View audit log** (`audit.read`) | Read the [Audit log](/docs/web-app/audit-log). Hosted edition only. | Organization |

## API keys

These permissions are available to people signing in to the app. API keys cannot carry them.

| Permission | What it allows | Scope |
| --- | --- | --- |
| **Create personal API keys** (`api_key.issue`) | Create personal API keys. | Organization |
| **Issue organization API keys** (`api_key.organization.issue`) | **Sensitive.** Create organization API keys and edit their permission policies. Hosted edition only. | Organization |
| **View all API keys** (`api_key.read`) | View every API key in the organization. | Organization |
| **Revoke any API key** (`api_key.revoke`) | Revoke any API key in the organization. | Organization |

## Billing

Billing permissions are available on hosted withHuman.

| Permission | What it allows | Scope |
| --- | --- | --- |
| **View the plan, seats, and usage** (`billing.read`) | View the organization's subscription and usage. | Organization |
| **Change the plan, adjust seats, and open the billing portal** (`billing.write`) | Manage the subscription, seat count and billing details. | Organization |

## Agent and gateway credentials

These permissions belong to credentials used by agents and the MCP gateway. They are not choices in member or team permission policies.

| Permission | What it allows | Used by |
| --- | --- | --- |
| **Create requests** (`request.create`) | Submit approval requests. | Agent instances |
| **Call MCP gateway tools** (`gateway.call`) | Call tools through the MCP gateway. | Gateway credentials |

Agents can also read their own requests and outcomes using the View requests permission.