Custom Roles
Create roles with granular permissions beyond the default Owner, Admin, and Member roles.
Custom Roles allow you to define fine-grained access control policies tailored to your organization's needs.
Default Roles
| Role | Description |
|---|---|
| Owner | Full access to all resources and settings |
| Admin | Manage users, projects, and services — cannot modify billing |
| Member | View and deploy within assigned projects |
Creating a Custom Role
- Navigate to Settings → Roles
- Click Create Role
- Enter a role name
- Configure permissions for each resource type:
Available Permissions
Each permission is an individual toggle, grouped by resource. Grant only the actions a role needs. A role saved with an older catalog is never silently downgraded: keys added later default to denied on existing roles, and any key a client omits when saving is left at its stored value rather than reset.
| Resource | Actions |
|---|---|
| Users | read, create, update, delete |
| Projects | create, update, delete |
| Services | read, create, update, delete |
| Deployments | read, cancel |
| Environments | read, create, update, delete |
| Service env vars | read, write |
| Project shared env vars | read, write |
| Volumes | read, create, update, delete |
| Backups | read, create, update, delete, restore |
| Volume backups | read, create, update, delete, restore |
| Schedules | read, create, update, delete |
| Domains | read, create, update, delete |
| Certificates | read, create, update, delete |
| Registries | read, create, update, delete |
| Git providers | read, create, update, delete |
| SSH keys | read, create, update, delete |
| Servers | read, create, update, delete |
| S3 destinations | read, create, update, delete |
| Notifications | read, create, update, delete |
| Monitoring | read |
| Audit logs | read |
| Docker | read, manage |
| Traefik files | write |
| API / CLI | read |
| App security | read, write |
| Observability | read, manage |
| Gateway keys | manage |
| Autoscaler | read, update |
| DevOps agent | read, act |
| Kubernetes clusters | read, create, update, delete |
| Cloud | read, manage, order |
| AI | read, create, update, delete |
| Linstor | read, manage |
| Swarm monitoring | read, manage |
| App thresholds | read, update |
| Code Review | read, manage repositories, manage settings, run review, view usage, moderate findings |
Assigning Roles
Roles are assigned at the organization level: a user has exactly one custom role at a time, granted by an organization owner or admin. Custom roles apply only to members whose base system role is Member — Owners and Admins already have full access and cannot be layered with a custom role. There is no per-project or per-environment role assignment; use each project's own access list to scope which projects a member can reach.