Permissions Matrix
Complete list of RBAC resources, actions, and default role grants.
DataHub authorization uses resource + action tokens. Permission strings combine action letters.
Action letters
| Action | Letter |
|---|---|
| create | c |
| read | r |
| update | u |
| delete | d |
| acknowledge | ack |
| share | share |
| start | start |
| stop | stop |
| adjust | adjust |
| export | export |
Example: crud = create + read + update + delete. r.ack = read + acknowledge.
Resources
| Resource | Console area |
|---|---|
| plants | Plants |
| machines | Machines |
| devices | Devices |
| tags | UNS Explorer |
| rules | Rules |
| alarms | Alarms |
| dashboards | Dashboards |
| programs | Programs |
| channels | Channels |
| users | Users |
| templates | Dashboard/program templates |
| maintenance | Maintenance, Baselines |
| inventory | Warehouses, Parts |
| wms | Products, Orders, Pallet types |
| production | Production stations |
| quality | Quality inbox, plans, NCRs, history, analysis report |
| telemetry | History export |
| settings | Settings |
| roles | Roles tab |
| audit | Audit tab |
| ops | Operations Center |
| assets | File attachments |
| screens | Site screens |
| catalog | Type lookups |
| platform | Platform health |
Default system roles
Built-in roles seed with these grants (custom roles can differ):
ADMIN
Full CRUD on operational resources; users, roles, audit, and platform read.
| Resource | Grant |
|---|---|
| plants … catalog | crud (or crud.share / crud.start.stop where applicable) |
| alarms | r.ack |
| inventory, wms | crud.adjust |
| quality | crud.ack.export |
| telemetry | r.export |
| users, roles | crud |
| audit | r |
| ops, platform | r |
OPERATOR
Day-to-day operations without user/role/audit admin or global delete.
| Resource | Grant |
|---|---|
| plants … screens, catalog | cru / cru.share / cru.start.stop / cru.adjust |
| quality | cru (no acknowledge / export) |
| alarms | r.ack |
| templates | r |
| telemetry | r.export |
| ops | r |
Denied: *.delete, users.*, roles.*, audit.*
VIEWER
Read-only on operational data.
| Resource | Grant |
|---|---|
| plants … catalog | r |
| quality | r |
| alarms | r (acknowledge not granted by default) |
| ops | r |
ENGINEER
Configuration-focused: devices, rules, programs, machines; limited inventory/WMS write.
| Resource | Grant |
|---|---|
| machines, devices, tags, rules | crud |
| programs | crud.start.stop |
| dashboards | crud.share |
| maintenance | crud |
| inventory, wms, quality | r |
| alarms | r.ack |
| ops | r |
Deny overrides
Denied actions use patterns:
*.delete— deny delete on all resourcesusers.*— deny all user management actionsplants.delete— deny delete on plants only
Deny always wins over allow in the permission map.
Each resource in the table above maps to a tag group in the REST API reference (for example Users, Roles, Plants, Rules).