A permission allows one kind of action in a Chalk environment. A built-in role has a
fixed set of permissions. A custom role or a service token has the permissions you select when you create it. This
page lists every permission you can select. For the permissions that common setup tasks need, see
Permissions in the Setup Guide.
To give a service token permissions, select them when you create the token under Settings > Access tokens. To
create a custom role, go to Settings > Users and roles, open the Groups (SCIM) tab, and click
Add a custom role. If the button is not there, contact Chalk to turn on custom roles for your environment.
The built-in roles build on each other in this order: Viewer, Data Scientist, Developer, Admin, Owner, and Team
Manager. Each role includes every permission of the role before it, plus the permissions in its row.
| Role | Permissions |
|---|
| Viewer | query.offline_read, deploy.read, migrate.read, cron.read, logs.list, monitoring.read, notebook.read, sandbox.read, function.read, scaling_group.read, image.read, volume.view, volume.read, artifact.read, workflow.read, model_registry.read, model_deployment.read, training.read, mcp_gateway.read, mcp_gateway.call, model_gateway.read, agents.read, secrets.list, tokens.list, team.list, billing.read |
| Data Scientist | All Viewer permissions, plus query.online, query.offline, deploy.preview, monitoring.create, notebook.write, notebook.manage, notebook.comment, notebook.share, training.manage |
| Developer | All Data Scientist permissions, plus migrate.plan, migrate.execute, cron.create |
| Admin | All Developer permissions, plus deploy.create, deploy.redeploy, sandbox.manage, sandbox.connect, function.manage, function.call, scaling_group.manage, image.build, volume.write, volume.manage, artifact.manage, workflow.run, workflow.manage, model_registry.manage, model_deployment.manage, model_deployment.call, mcp_gateway.manage, model_gateway.manage, secrets.decrypt, secrets.write, tokens.write |
| Owner | All Admin permissions, plus agents.write, team.add, team.delete, team.admin, project.create, infrastructure.read |
| Team Manager | All Owner permissions, plus environment.create |
Admin and the roles after it also include billing.write and image.pull, which you cannot select for a custom role
or service token. Team Manager applies in every environment of a team; see
User permissions and RBAC.
In the permission tables below, the Built-in roles column names the first role that includes each permission.
Every role after it includes the permission too.
The permissions for notebooks, sandboxes, functions, scaling groups, images, volumes, artifacts, workflows, the model
registry, model deployments, and training cover actions that also accept an older permission, such as deploy.read
for viewing and deploy.create or deploy.redeploy for changes. A custom role or token with the older permission can
take those actions without the newer one.
These permissions cover querying features, deploying, and running migrations and scheduled runs.
| Permission | Allows | Built-in roles |
|---|
query.online | Query online features | Data Scientist and up |
query.offline | Query offline features | Data Scientist and up |
query.offline_read | Read offline queries and datasets | Viewer and up |
| Permission | Allows | Built-in roles |
|---|
deploy.read | Read information about deployments | Viewer and up |
deploy.preview | Create a branch deployment | Data Scientist and up |
deploy.create | Create a deployment | Admin and up |
deploy.redeploy | Redeploy an existing deployment | Admin and up |
| Permission | Allows | Built-in roles |
|---|
migrate.read | View information about migrations | Viewer and up |
migrate.plan | Create a migration plan | Developer and up |
migrate.execute | Run a migration plan | Developer and up |
| Permission | Allows | Built-in roles |
|---|
cron.read | Read scheduled runs | Viewer and up |
cron.create | Trigger a scheduled run | Developer and up |
| Permission | Allows | Built-in roles |
|---|
logs.list | Read resolver logs | Viewer and up |
monitoring.read | View charts and alerts | Viewer and up |
monitoring.create | Create charts and alerts | Data Scientist and up |
These permissions cover hosted notebooks. notebook.write alone is enough to create, edit,
and run them.
| Permission | Allows | Built-in roles |
|---|
notebook.read | Read notebooks, results, revisions, and comments | Viewer and up |
notebook.write | Edit and run notebooks | Data Scientist and up |
notebook.manage | Create, archive, and delete notebooks, and manage notebook settings and runtimes | Data Scientist and up |
notebook.comment | Comment on notebooks | Data Scientist and up |
notebook.share | Create and revoke notebook share links | Data Scientist and up |
These permissions cover the workloads you run on Chalk and the models you train and deploy there.
| Permission | Allows | Built-in roles |
|---|
sandbox.read | View sandboxes, snapshots, and sessions | Viewer and up |
sandbox.manage | Create, suspend, resume, and terminate sandboxes, and manage snapshots | Admin and up |
sandbox.connect | Run commands, open sessions, and transfer files in sandboxes | Admin and up |
| Permission | Allows | Built-in roles |
|---|
function.read | View functions, versions, source code, scheduled runs, and recent call history | Viewer and up |
function.manage | Create, update, and delete functions and function versions | Admin and up |
function.call | Call functions and read call results | Admin and up |
| Permission | Allows | Built-in roles |
|---|
scaling_group.read | View scaling groups, replicas, and revisions | Viewer and up |
scaling_group.manage | Create, update, and delete scaling groups | Admin and up |
| Permission | Allows | Built-in roles |
|---|
image.read | View images, builds, and build logs | Viewer and up |
image.build | Build images | Admin and up |
| Permission | Allows | Built-in roles |
|---|
volume.view | View volume metadata, refs, and versions | Viewer and up |
volume.read | Read volume files and get read-only volume credentials | Viewer and up |
volume.write | Write volume files, commit versions, and manage refs | Admin and up |
volume.manage | Create and delete volumes | Admin and up |
| Permission | Allows | Built-in roles |
|---|
artifact.read | List and download artifacts | Viewer and up |
artifact.manage | Upload, finalize, and delete artifacts | Admin and up |
| Permission | Allows | Built-in roles |
|---|
workflow.read | View workflows, their history and messages, and workflow schedules and runs | Viewer and up |
workflow.run | Start workflow runs, send workflow messages, and trigger workflow schedules | Admin and up |
workflow.manage | Create, update, and delete workflow schedules | Admin and up |
| Permission | Allows | Built-in roles |
|---|
model_registry.read | View the model registry and download model artifacts | Viewer and up |
model_registry.manage | Register, update, and delete models, versions, aliases, and artifacts | Admin and up |
| Permission | Allows | Built-in roles |
|---|
model_deployment.read | View model deployments and curated models | Viewer and up |
model_deployment.manage | Deploy, update, and delete models | Admin and up |
model_deployment.call | Call deployed models | Admin and up |
| Permission | Allows | Built-in roles |
|---|
training.read | View training runs, checkpoints, and experiments | Viewer and up |
training.manage | Start, cancel, and report on training runs and experiments | Data Scientist and up |
These permissions cover the MCP Gateway, the Model Gateway, and the
Chalk Assistant.
| Permission | Allows | Built-in roles |
|---|
mcp_gateway.read | View MCP Gateway servers, policies, agents, tool belts, and audit logs | Viewer and up |
mcp_gateway.call | Call MCP Gateway tools, resources, and prompts, check and simulate policies, and link OAuth accounts | Viewer and up |
mcp_gateway.manage | Create, update, and delete MCP Gateway servers, policies, agents, and tool belts | Admin and up |
| Permission | Allows | Built-in roles |
|---|
model_gateway.read | View Model Gateway routes, connections, policies, limits, and usage, and call models | Viewer and up |
model_gateway.manage | Manage Model Gateway API keys, provider connections, routes, policies, limits, budgets, and telemetry | Admin and up |
| Permission | Allows | Built-in roles |
|---|
agents.read | Use the Chalk Assistant | Viewer and up |
agents.write | Create, change, and delete AI provider connections | Owner and up |
These permissions cover secrets, service tokens, team members, and environments.
| Permission | Allows | Built-in roles |
|---|
secrets.list | See the list of secrets, without reading their values | Viewer and up |
secrets.decrypt | Decrypt secret values | Admin and up |
secrets.write | Create, change, and delete secret values | Admin and up |
| Permission | Allows | Built-in roles |
|---|
tokens.list | List service tokens and see their client IDs, but not their client secrets | Viewer and up |
tokens.write | Create, change, and delete service tokens | Admin and up |
| Permission | Allows | Built-in roles |
|---|
team.list | See the members of your organization | Viewer and up |
team.add | Add members to your organization | Owner and up |
team.delete | Remove a member | Owner and up |
team.admin | Configure authentication options for your organization | Owner and up |
| Permission | Allows | Built-in roles |
|---|
billing.read | Read billing information | Viewer and up |
project.create | Create a project | Owner and up |
environment.create | Create and manage environments | Team Manager |
| Permission | Allows | Built-in roles |
|---|
infrastructure.read | Read infrastructure workflows | Owner and up |
infrastructure.write | Approve or cancel infrastructure workflows | None |