RBAC (Role-Based Access Control)

Role-based access control (RBAC) determines what each member of your organization can do on the Chainlink Platform. This page describes the roles available for each product, what each role can do, and how to manage roles for your organization members.

How RBAC works

Each organization member is assigned a role for each product. The role determines the permissions the member has for that product. For example, a member can be a CRE Admin and an ACE Viewer at the same time.

• A member can hold a different role for each product.
• A member can have no role for a product. A member without a role for a product has no access to that product.
• Roles are managed per product. A member's role for one product does not affect their access to other products.

The Owner role

The first user to create an organization is automatically assigned the Owner role. The Owner role includes every permission for every product, including all future products. This covers:

• Managing members and their roles for every product
• Creating and managing API keys
• Managing organization settings and addresses

There is exactly one Owner per organization, and the Owner role cannot be transferred.

Roles and permissions

Each product section below starts with a summary of its roles, followed by a table of the permissions each role includes. The Name column matches the label shown in the app when you preview a role's permissions or select API key permissions. A check mark indicates that the role includes the permission. The Owner role includes every permission in every table.

Reading permission IDs

Each permission has an ID in the format product:resource:action. You see these IDs when you choose API key permissions, and in error messages when a request is missing a permission. Most IDs follow the same few patterns:

• read permissions let you view a resource. write permissions let you create and update it.
• archive:write permissions let you archive a resource. Archiving is separate from write because archiving some resources also affects everything built on them. For this reason, some roles can create and update a resource but not archive it.
• A suffix after a slash limits a permission to one scope. For example, platform:member_role:write/cre allows changing CRE roles only, and platform:member_role:write/* allows changing roles for every product.
• Permissions that start with platform: but end with a product scope, such as platform:limits:write/cre, are organization-level permissions limited to that product. They appear in that product's table.

Managing member roles

Members with the appropriate permissions can assign and change roles for other members:

• Platform Admins can manage member roles for all products.
• Product Admins (for example, CRE Admins) can manage member roles for their product.
• The Owner can manage member roles for all products.

To assign or change a member's roles, see Assigning and Modifying Roles.

What's next?

• Assigning and Modifying Roles - Change the roles that organization members hold for each product.

• API Keys - Create API keys with scoped permissions for each product.

• Inviting Team Members - Add members to your organization.
• Understanding Organizations - Learn how organizations work on the Chainlink Platform.