# Permissions source: https://docs.chalk.ai/docs/permissions ## Every permission you can give a custom role or service token, and the built-in roles that include it. A permission allows one kind of action in a Chalk environment. A built-in role has a fixed set of permissions. A custom role or a service token has the permissions you select when you create it. This page lists every permission you can select. For the permissions that common setup tasks need, see Permissions in the Setup Guide. To give a service token permissions, select them when you create the token under Settings > Access tokens. To create a custom role, go to Settings > Users and roles, open the Groups (SCIM) tab, and click Add a custom role. If the button is not there, contact Chalk to turn on custom roles for your environment. ### Built-in roles The built-in roles build on each other in this order: Viewer, Data Scientist, Developer, Admin, Owner, and Team Manager. Each role includes every permission of the role before it, plus the permissions in its row. | Role | Permissions | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Viewer** | `query.offline_read`, `deploy.read`, `migrate.read`, `cron.read`, `logs.list`, `monitoring.read`, `notebook.read`, `sandbox.read`, `function.read`, `scaling_group.read`, `image.read`, `volume.view`, `volume.read`, `artifact.read`, `workflow.read`, `model_registry.read`, `model_deployment.read`, `training.read`, `mcp_gateway.read`, `mcp_gateway.call`, `model_gateway.read`, `agents.read`, `secrets.list`, `tokens.list`, `team.list`, `billing.read` | | **Data Scientist** | All Viewer permissions, plus `query.online`, `query.offline`, `deploy.preview`, `monitoring.create`, `notebook.write`, `notebook.manage`, `notebook.comment`, `notebook.share`, `training.manage` | | **Developer** | All Data Scientist permissions, plus `migrate.plan`, `migrate.execute`, `cron.create` | | **Admin** | All Developer permissions, plus `deploy.create`, `deploy.redeploy`, `sandbox.manage`, `sandbox.connect`, `function.manage`, `function.call`, `scaling_group.manage`, `image.build`, `volume.write`, `volume.manage`, `artifact.manage`, `workflow.run`, `workflow.manage`, `model_registry.manage`, `model_deployment.manage`, `model_deployment.call`, `mcp_gateway.manage`, `model_gateway.manage`, `secrets.decrypt`, `secrets.write`, `tokens.write` | | **Owner** | All Admin permissions, plus `agents.write`, `team.add`, `team.delete`, `team.admin`, `project.create`, `infrastructure.read` | | **Team Manager** | All Owner permissions, plus `environment.create` | Admin and the roles after it also include billing.write and image.pull, which you cannot select for a custom role or service token. Team Manager applies in every environment of a team; see User permissions and RBAC. In the permission tables below, the Built-in roles column names the first role that includes each permission. Every role after it includes the permission too. The permissions for notebooks, sandboxes, functions, scaling groups, images, volumes, artifacts, workflows, the model registry, model deployments, and training cover actions that also accept an older permission, such as deploy.read for viewing and deploy.create or deploy.redeploy for changes. A custom role or token with the older permission can take those actions without the newer one. ### Queries and deployments These permissions cover querying features, deploying, and running migrations and scheduled runs. ### Queries | Permission | Allows | Built-in roles | | -------------------- | --------------------------------- | --------------------- | | `query.online` | Query online features | Data Scientist and up | | `query.offline` | Query offline features | Data Scientist and up | | `query.offline_read` | Read offline queries and datasets | Viewer and up | ### Deployments | Permission | Allows | Built-in roles | | ----------------- | -------------------------------------------- | --------------------- | | `deploy.read` | Read information about deployments | Viewer and up | | `deploy.preview` | Create a [branch](/docs/branches) deployment | Data Scientist and up | | `deploy.create` | Create a deployment | Admin and up | | `deploy.redeploy` | Redeploy an existing deployment | Admin and up | ### Migrations | Permission | Allows | Built-in roles | | ----------------- | --------------------------------- | ---------------- | | `migrate.read` | View information about migrations | Viewer and up | | `migrate.plan` | Create a migration plan | Developer and up | | `migrate.execute` | Run a migration plan | Developer and up | ### Scheduled runs | Permission | Allows | Built-in roles | | ------------- | ----------------------- | ---------------- | | `cron.read` | Read scheduled runs | Viewer and up | | `cron.create` | Trigger a scheduled run | Developer and up | ### Logs and monitoring | Permission | Allows | Built-in roles | | ------------------- | ------------------------ | --------------------- | | `logs.list` | Read resolver logs | Viewer and up | | `monitoring.read` | View charts and alerts | Viewer and up | | `monitoring.create` | Create charts and alerts | Data Scientist and up | ### Notebooks These permissions cover hosted notebooks. notebook.write alone is enough to create, edit, and run them. | Permission | Allows | Built-in roles | | ------------------ | -------------------------------------------------------------------------------- | --------------------- | | `notebook.read` | Read notebooks, results, revisions, and comments | Viewer and up | | `notebook.write` | Edit and run notebooks | Data Scientist and up | | `notebook.manage` | Create, archive, and delete notebooks, and manage notebook settings and runtimes | Data Scientist and up | | `notebook.comment` | Comment on notebooks | Data Scientist and up | | `notebook.share` | Create and revoke notebook share links | Data Scientist and up | ### Runtime and Learning These permissions cover the workloads you run on Chalk and the models you train and deploy there. ### Sandboxes | Permission | Allows | Built-in roles | | ----------------- | ---------------------------------------------------------------------- | -------------- | | `sandbox.read` | View sandboxes, snapshots, and sessions | Viewer and up | | `sandbox.manage` | Create, suspend, resume, and terminate sandboxes, and manage snapshots | Admin and up | | `sandbox.connect` | Run commands, open sessions, and transfer files in sandboxes | Admin and up | ### Functions | Permission | Allows | Built-in roles | | ----------------- | ------------------------------------------------------------------------------ | -------------- | | `function.read` | View functions, versions, source code, scheduled runs, and recent call history | Viewer and up | | `function.manage` | Create, update, and delete functions and function versions | Admin and up | | `function.call` | Call functions and read call results | Admin and up | ### Scaling groups | Permission | Allows | Built-in roles | | ---------------------- | -------------------------------------------- | -------------- | | `scaling_group.read` | View scaling groups, replicas, and revisions | Viewer and up | | `scaling_group.manage` | Create, update, and delete scaling groups | Admin and up | ### Images | Permission | Allows | Built-in roles | | ------------- | ----------------------------------- | -------------- | | `image.read` | View images, builds, and build logs | Viewer and up | | `image.build` | Build images | Admin and up | ### Volumes | Permission | Allows | Built-in roles | | --------------- | ------------------------------------------------------ | -------------- | | `volume.view` | View volume metadata, refs, and versions | Viewer and up | | `volume.read` | Read volume files and get read-only volume credentials | Viewer and up | | `volume.write` | Write volume files, commit versions, and manage refs | Admin and up | | `volume.manage` | Create and delete volumes | Admin and up | ### Artifacts | Permission | Allows | Built-in roles | | ----------------- | -------------------------------------- | -------------- | | `artifact.read` | List and download artifacts | Viewer and up | | `artifact.manage` | Upload, finalize, and delete artifacts | Admin and up | ### Workflows | Permission | Allows | Built-in roles | | ----------------- | --------------------------------------------------------------------------- | -------------- | | `workflow.read` | View workflows, their history and messages, and workflow schedules and runs | Viewer and up | | `workflow.run` | Start workflow runs, send workflow messages, and trigger workflow schedules | Admin and up | | `workflow.manage` | Create, update, and delete workflow schedules | Admin and up | ### Model registry | Permission | Allows | Built-in roles | | ----------------------- | --------------------------------------------------------------------- | -------------- | | `model_registry.read` | View the model registry and download model artifacts | Viewer and up | | `model_registry.manage` | Register, update, and delete models, versions, aliases, and artifacts | Admin and up | ### Model deployments | Permission | Allows | Built-in roles | | ------------------------- | ----------------------------------------- | -------------- | | `model_deployment.read` | View model deployments and curated models | Viewer and up | | `model_deployment.manage` | Deploy, update, and delete models | Admin and up | | `model_deployment.call` | Call deployed models | Admin and up | ### Training | Permission | Allows | Built-in roles | | ----------------- | ---------------------------------------------------------- | --------------------- | | `training.read` | View training runs, checkpoints, and experiments | Viewer and up | | `training.manage` | Start, cancel, and report on training runs and experiments | Data Scientist and up | ### Gateways and the Chalk Assistant These permissions cover the MCP Gateway, the Model Gateway, and the Chalk Assistant. ### MCP Gateway | Permission | Allows | Built-in roles | | -------------------- | ---------------------------------------------------------------------------------------------------- | -------------- | | `mcp_gateway.read` | View MCP Gateway servers, policies, agents, tool belts, and audit logs | Viewer and up | | `mcp_gateway.call` | Call MCP Gateway tools, resources, and prompts, check and simulate policies, and link OAuth accounts | Viewer and up | | `mcp_gateway.manage` | Create, update, and delete MCP Gateway servers, policies, agents, and tool belts | Admin and up | ### Model Gateway | Permission | Allows | Built-in roles | | ---------------------- | ----------------------------------------------------------------------------------------------------- | -------------- | | `model_gateway.read` | View Model Gateway routes, connections, policies, limits, and usage, and call models | Viewer and up | | `model_gateway.manage` | Manage Model Gateway API keys, provider connections, routes, policies, limits, budgets, and telemetry | Admin and up | ### Chalk Assistant | Permission | Allows | Built-in roles | | -------------- | -------------------------------------------------- | -------------- | | `agents.read` | Use the Chalk Assistant | Viewer and up | | `agents.write` | Create, change, and delete AI provider connections | Owner and up | ### Administration These permissions cover secrets, service tokens, team members, and environments. ### Secrets | Permission | Allows | Built-in roles | | ----------------- | ----------------------------------------------------- | -------------- | | `secrets.list` | See the list of secrets, without reading their values | Viewer and up | | `secrets.decrypt` | Decrypt secret values | Admin and up | | `secrets.write` | Create, change, and delete secret values | Admin and up | ### Service tokens | Permission | Allows | Built-in roles | | -------------- | -------------------------------------------------------------------------- | -------------- | | `tokens.list` | List service tokens and see their client IDs, but not their client secrets | Viewer and up | | `tokens.write` | Create, change, and delete service tokens | Admin and up | ### Team | Permission | Allows | Built-in roles | | ------------- | ------------------------------------------------------ | -------------- | | `team.list` | See the members of your organization | Viewer and up | | `team.add` | Add members to your organization | Owner and up | | `team.delete` | Remove a member | Owner and up | | `team.admin` | Configure authentication options for your organization | Owner and up | ### Projects, environments, and billing | Permission | Allows | Built-in roles | | -------------------- | ------------------------------ | -------------- | | `billing.read` | Read billing information | Viewer and up | | `project.create` | Create a project | Owner and up | | `environment.create` | Create and manage environments | Team Manager | ### Infrastructure | Permission | Allows | Built-in roles | | ---------------------- | ------------------------------------------ | -------------- | | `infrastructure.read` | Read infrastructure workflows | Owner and up | | `infrastructure.write` | Approve or cancel infrastructure workflows | None |