Roles and permissions
Understand the roles in a Kabeen workspace, create custom roles and choose the permissions of each member
Access to actions within a Kabeen workspace depends on the role assigned to each member. A role groups a set of permissions: depending on these permissions, some features (editing, deletion, member management, workspace settings) are available or hidden in the interface.
System roles
Every workspace comes with three ready-made roles. These system roles cannot be edited or deleted.
- Reader: read-only access. A Reader can view the workspace's data but cannot edit or delete anything.
- Editor: can add and edit the workspace's data (applications, servers, networks, data, contracts, organisation, announcements…), in addition to viewing it.
- Owner: has every right. On top of that, the Owner can delete objects, manage members and roles and change the workspace settings.
| Action | Reader | Editor | Owner |
|---|---|---|---|
| View | Yes | Yes | Yes |
| Add and edit | No | Yes | Yes |
| Delete | No | No | Yes |
| Export (Settings › Export) | Yes | Yes | Yes |
| Invite members and manage roles | No | No | Yes |
| Change the workspace settings | No | No | Yes |
An export only contains the resources you are allowed to view.
Custom roles
If the system roles don't match your organisation, create your own roles and choose exactly which permissions they grant.
- Open Settings › Permissions. The Permissions & Roles page lists your custom roles and how many members use each one.
- Click Manage custom roles, then Create a custom role.
- Give the role a name and an icon.
- Tick the role's permissions, resource by resource.
To edit or delete a custom role, use the ⋮ menu on its row. Before deleting a role, assign another role to the members who use it.
Only members allowed to manage members (for example with the Owner role) can create, edit or delete a role.
The permissions table
Permissions are shown as a table, grouped by family (Main resources, Cross-functional resources, Dashboards, Diagrams, Agents, Administration…). For each resource, you tick the allowed actions:
- Read: view the resource;
- Add: create new items;
- Edit: change existing items;
- Delete: delete items;
- Comment or Export, for the resources that offer these actions.
Some read permissions are mandatory and always ticked: Workspace, Categories and Tags.
Infrastructure permissions
Infrastructure is split into three separate resources, so you can, for example, give access to servers without opening networks:
| Resource | What it covers | Actions |
|---|---|---|
| Servers | Servers, whether added manually or reported by the server agent, and their interfaces | Read, Add, Edit, Delete |
| Networks | Networks and network devices (routers, firewalls, switches, access points) | Read, Add, Edit, Delete |
| Devices | Workstations and mobile devices | Read, Edit |
These three resources replace the former single "Infrastructure" permission. Existing roles and API keys have kept their access: a role that had an action on infrastructure now has it on servers and on networks. The Devices permission was granted for reading to the roles that could already view workstations, and for editing to those that could edit users.
Among the system roles, the Reader can Read devices; the Editor and the Owner can also Edit them (for example to fill in a device's custom fields).
Features that need several permissions
Some screens combine several resources and need read access to all of them. For example, the Potential optimizations of the Finance dashboard (licence optimisation) rely on the amounts and licence counts of contracts: they need Read on both Applications and Contracts.
"An action has disappeared from my interface"
If an icon or a command no longer appears (for example deleting an application or adding a server), this is usually normal behaviour linked to your role, not a malfunction.
The available actions are filtered according to your permissions: a Reader doesn't see edit or delete actions, and a whole section can be hidden if your role cannot read the resource. In that case, Kabeen shows the message "You do not have the necessary rights to view this type of resource."
Changing role
To get a missing action back, ask a workspace Owner to give you another role, or to add the missing permission to your custom role. Members' roles are managed from Settings › Members.
Note
Managing certain email notifications (for example turning off the weekly report via the link in the email) may require an elevated role. If you are blocked, contact support.