Permissions
Permissions control what people, AI agents and API tokens can do. People and API tokens get permissions from a role. AI agents get the permissions you approve, limited to what the approving person has.
Day-to-day operations without root. New invitations use this role by default.
Observe
- View device detailsIdentity, connection and last reported system information.
device.readAllowed - View servicesSee the services a device reports.
services.readAllowed - Read metricsSystem and process measurements.
metrics.readAllowed - Read logsCollected service logs.
logs.readAllowed - Read activity and recordingsSubmitted commands, outcomes and full terminal recordings.
audit.readAllowed
Operate
- Restart servicesRestart a service without general sudo.
services.restartAllowed - Change monitoring settingsTurn collection on and choose services.
monitoring.writeAllowed - Edit device detailsRename devices and change tags.
device.writeAllowed - Update the Suta agentInstall a published agent release.
agent.updateAllowed - Configure networkingApprove local network repair.
network.writeNot allowed
Connect & administer
- Manage remote accessOpen, change or close a remote access window.
access.writeAllowed - Run commandsRun commands and terminals without sudo.
commands.execAllowed - Run commands with sudoFull administration of the device.
commands.sudoNot allowed - Enroll devicesAdd new devices to the workspace.
device.enrollNot allowed - Remove devicesRemove devices and revoke their access.
device.removeNot allowed
All permissions
Section titled “All permissions”| Permission | ID | Allows |
|---|---|---|
| View device details | device.read |
Identity, version, network and connection details. Every other permission includes this. |
| View services | services.read |
The services a device last reported. |
| Read metrics | metrics.read |
System and process measurements. |
| Read logs | logs.read |
Collected service logs. |
| Restart services | services.restart |
Restarting services, without general sudo. |
| Change monitoring settings | monitoring.write |
Turning collection on or off and choosing services. |
| Manage remote access | access.write |
Opening, changing and closing remote access. |
| Run commands | commands.exec |
Commands and terminals as an unprivileged user. |
| Run commands with sudo | commands.sudo |
Commands and terminals with full sudo. |
| Read activity and recordings | audit.read |
Operation history and terminal recordings. |
| Edit device details | device.write |
Renaming devices and changing tags. |
| Remove devices | device.remove |
Removing devices and revoking their access. |
| Enroll devices | device.enroll |
Adding devices to the workspace. |
| Configure networking | network.write |
Approving local network repair. |
| Update the Suta agent | agent.update |
Installing a published agent version. |
Each permission applies to all devices in the workspace, including future ones, or to devices you choose. Three permissions can also be limited to named services: View services, Read logs and Restart services. Read logs can also be limited to a fixed time range.