> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zenable.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and Permissions

> Control access with role-based permissions

## Overview

Zenable uses Role-Based Access Control (RBAC) to manage who can do what within your organization. The system follows these principles:

* **Permissions** are atomic actions (e.g., "edit requirements")
* **Roles** bundle permissions together (e.g., "Admin" has many permissions)
* **Users** are assigned roles directly or via identity provider groups

## Check your permissions from the CLI

Not sure whether you can do something? The [Zenable CLI](/integrations/zenable/commands?utm_source=docs\&utm_medium=web) answers it directly. `zenable auth can-i` prints `yes` or `no` (and sets a matching exit code, so it's scriptable) for any RBAC permission **or** MCP tool:

<CodeGroup>
  ```bash Check a permission theme={null}
  zenable auth can-i requirements:write
  ```

  ```bash Check an MCP tool theme={null}
  zenable auth can-i get_findings
  ```

  ```bash List everything you can and cannot do theme={null}
  zenable auth can-i --list
  ```
</CodeGroup>

Every permission in the matrix below and every Zenable MCP tool is covered. `--list` shows them all at once with each one's grant status.

<Note>
  Don't have the CLI yet? See the [installation guide](/integrations/zenable/commands?utm_source=docs\&utm_medium=web#quick-installation).
</Note>

## System Roles

Zenable provides six predefined roles that cover common access patterns:

| Role | Description | Key Capabilities |
| - | - | - |
| **Viewer** | Read-only access | View requirements, users, integrations, settings, marketplace catalog |
| **Contributor** | Create and edit content | All Viewer permissions + write/export requirements, subscribe to marketplace items |
| **Admin** | Full admin access (billing read-only) | All Contributor + manage users, roles, integrations, audit logs |
| **Owner** | Complete access | All Admin + billing management |
| **Billing Administrator** | Financial access | View everything + manage billing and invoices |
| **Security Auditor** | Audit + governance access | View/export audit logs, view requirements, guardrails, and governance |

<Note>
  Custom roles are available on Enterprise plans. Contact us to learn more.
</Note>

## Groups

Groups are tenant-owned sets of users, created and managed on the [Groups tab in Company Settings](https://www.zenable.app/settings?tab=groups\&utm_source=docs\&utm_medium=web). They are referenced by `GROUP` requirement scopes (see [`groups:read` / `groups:write`](#groups)).

A group can also contain other groups, so a scope on a parent group reaches members of its nested teams.

<Note>
  Group nesting is capped at 3 levels deep; members nested below that are not included.
</Note>

## RBAC Audit Logging

<Info>
  RBAC Audit logging is available on **Professional** and **Enterprise** plans only. Log exporting requires an **Enterprise** plan.
</Info>

All role and permission assignments and revocations are logged for compliance, including any provided reason.

Audit logs cannot be deleted by users regardless of role.

Access audit logs via the **Audit** section in the management console or through the `audit:read` permission.

## Role Permission Matrix

| Permission | Viewer | Contributor | Admin | Owner | Billing Admin | Security Auditor |
| - | :-: | :-: | :-: | :-: | :-: | :-: |
| requirements:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| requirements:write | | ✓ | ✓ | ✓ | | |
| requirements:delete | | | ✓ | ✓ | | |
| requirements:export | | ✓ | ✓ | ✓ | | |
| context:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| context:write | | ✓ | ✓ | ✓ | | |
| scopes:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| scopes:write | | ✓ | ✓ | ✓ | | |
| groups:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| groups:write | | ✓ | ✓ | ✓ | | |
| guardrails:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| guardrails:write | | ✓ | ✓ | ✓ | | |
| findings:read | ✓ | ✓ | ✓ | ✓ | | |
| findings:manage | | ✓ | ✓ | ✓ | | |
| reports:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| reports:write | | ✓ | ✓ | ✓ | | |
| users:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| users:invite | | | ✓ | ✓ | | |
| users:remove | | | ✓ | ✓ | | |
| users:manage | | | ✓ | ✓ | | |
| users:manage\_seats | | | ✓ | ✓ | | |
| roles:read | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| roles:manage | | | ✓ | ✓ | | |
| billing:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| billing:manage | | | | ✓ | ✓ | |
| billing:view\_invoices | | | | ✓ | ✓ | |
| audit:read | | | ✓ | ✓ | | ✓ |
| audit:export | | | ✓ | ✓ | | ✓ |
| governance:read | ✓ | ✓ | ✓ | ✓ | | ✓ |
| governance:manage | | | ✓ | ✓ | | |
| governance:delete | | | ✓ | ✓ | | |
| integrations:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| integrations:manage | | | ✓ | ✓ | | |
| integrations:link\_self | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| settings:read | ✓ | ✓ | ✓ | ✓ | ✓ | |
| settings:manage | | | ✓ | ✓ | | |
| learning\_hub:read | ✓ | ✓ | ✓ | ✓ | | |
| learning\_hub:sandbox | ✓ | ✓ | ✓ | ✓ | | |
| feature\_flags:read | | | ✓ | ✓ | | |
| feature\_flags:manage | | | ✓ | ✓ | | |
| marketplace:read | ✓ | ✓ | ✓ | ✓ | | |
| marketplace:manage | | ✓ | ✓ | ✓ | | |
| marketplace:publish | | | | | | |
| requirements:approve | | ✓ | ✓ | ✓ | | |
| guardrails:approve | | ✓ | ✓ | ✓ | | |
| approvals:read | ✓ | ✓ | ✓ | ✓ | | |
| approvals:feedback | | ✓ | ✓ | ✓ | | |
| approvals:manage | | | ✓ | ✓ | | |
| feedback:read | | ✓ | ✓ | ✓ | | |
| feedback:write | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| company:manage | | | | ✓ | | |

## Permissions by Category

### Requirements

| Permission | Description |
| - | - |
| `requirements:read` | View and search requirements |
| `requirements:write` | Create and edit requirements |
| `requirements:delete` | Permanently delete requirements and associated guardrails |
| `requirements:export` | Export requirements to external formats |

<Warning>
  Deleting a requirement is permanent and also deletes all guardrails associated with that requirement. This action cannot be undone.
</Warning>

### Context

| Permission | Description |
| - | - |
| `context:read` | View reviewer contexts at customer and tenant levels |
| `context:write` | Create, edit, and delete reviewer contexts |

### Scopes

| Permission | Description | Minimum Tier |
| - | - | - |
| `scopes:read` | View scope definitions | Professional |
| `scopes:write` | Create, edit, and delete scope definitions, and cast a binding decision on scope [approval requests](/approval-workflows#who-can-decide-what) | Professional |

### Groups

| Permission | Description | Minimum Tier |
| - | - | - |
| `groups:read` | View groups and their members | Professional |
| `groups:write` | Create, edit, and delete groups and manage their members, and cast a binding decision on group [approval requests](/approval-workflows#who-can-decide-what) | Professional |

Groups are tenant-owned sets of users referenced by `GROUP` requirement scopes. They are gated like scopes, since they're only useful via scoping.

### Guardrails

| Permission | Description | Minimum Tier |
| - | - | - |
| `guardrails:read` | View guardrails | Professional |
| `guardrails:write` | Create, edit, and delete guardrails | Professional |

### Findings

| Permission | Description | Minimum Tier |
| - | - | - |
| `findings:read` | View code review findings and resolutions | Professional |
| `findings:manage` | Create, update, and resolve findings | Professional |

### Reports

| Permission | Description |
| - | - |
| `reports:read` | View assessment reports |
| `reports:write` | Upload assessment reports |

### Users

| Permission | Description |
| - | - |
| `users:read` | View team members |
| `users:invite` | Invite new users |
| `users:remove` | Remove users from tenant |
| `users:manage` | Assign and revoke roles, and link third-party identities (e.g. GitHub or GitLab accounts) to users |
| `users:manage_seats` | Release and reassign seat licenses for users in tenant |

### Roles

| Permission | Description |
| - | - |
| `roles:read` | View custom roles and their permissions |
| `roles:manage` | Create, edit, delete, promote, and demote custom roles |

### Billing

| Permission | Description |
| - | - |
| `billing:read` | View billing information |
| `billing:manage` | Modify subscription |
| `billing:view_invoices` | Download invoices |

### Audit

| Permission | Description | Minimum Tier |
| - | - | - |
| `audit:read` | View audit logs | Professional |
| `audit:export` | Export audit logs | Enterprise |

### Governance

| Permission | Description | Minimum Tier |
| - | - | - |
| `governance:read` | View governance domains and evidence | Professional |
| `governance:manage` | Create and edit governance domains and map requirements to them | Professional |
| `governance:delete` | Delete governance domains from the tenant taxonomy | Professional |

<Warning>
  Deleting a governance domain is permanent. Requirements mapped to the domain must be reassigned or explicitly unmapped as part of the deletion flow.
</Warning>

### Integrations

| Permission | Description |
| - | - |
| `integrations:read` | View configured integrations |
| `integrations:manage` | Add, remove, configure integrations |
| `integrations:link_self` | Link your own GitHub or GitLab account to your Zenable user, one per integration, from your profile. Linking someone else's requires `users:manage` |

### Settings

| Permission | Description |
| - | - |
| `settings:read` | View tenant settings |
| `settings:manage` | Modify tenant configuration, and cast a binding decision on guardrail runtime-settings and configuration-proposal [approval requests](/approval-workflows#who-can-decide-what) |

### Learning Hub

| Permission | Description |
| - | - |
| `learning_hub:read` | View Learning Hub training content: workshops, labs, and slide decks. Individual content can additionally require a subscription tier |
| `learning_hub:sandbox` | Launch a personal sandbox environment (bounded by the customer's sandbox limits), view session status, and connect to assigned environments. Bulk or scheduled sessions additionally require `settings:manage` |

### Feature Flags

| Permission | Description |
| - | - |
| `feature_flags:read` | View feature flags |
| `feature_flags:manage` | Enable/disable feature flags |

### Marketplace

| Permission | Description | Minimum Tier |
| - | - | - |
| `marketplace:read` | Browse marketplace catalog, bundles, and requirements | — |
| `marketplace:manage` | Subscribe, unsubscribe, pin, and customize marketplace items for a workspace | Professional |
| `marketplace:publish` | Publish new versions of marketplace requirements | Enterprise |

### Approvals

| Permission | Description | Minimum Tier |
| - | - | - |
| `requirements:approve` | Cast a binding approve/reject decision on requirement proposals, including merges and splits | Professional |
| `guardrails:approve` | Cast a binding approve/reject decision on guardrail regeneration and custom-guardrail requests | Professional |
| `approvals:read` | View approval flows, pending requests, and the full feedback thread (everything is transparent — no per-record hiding) | Professional |
| `approvals:feedback` | Submit non-binding feedback (vote up/down, add commentary) on an approval request | Professional |
| `approvals:manage` | Create, edit, and archive approval flow definitions, [approval policies](/approval-policies), and target selectors — the approval machinery, not the changes it gates | Professional |

Learn more about [approval workflows](/approval-workflows).

### Feedback

| Permission | Description |
| - | - |
| `feedback:read` | View feedback |
| `feedback:write` | Submit feedback |

### Company

| Permission | Description |
| - | - |
| `company:manage` | Manage company-wide settings that apply across every tenant (owner only) |

<Note>
  **Need help?** Contact us at [hello@zenable.io](mailto:hello@zenable.io)
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.