Permissions
Look up every permission that SpiralDB checks, the service that checks it, and the OAuth scope that delegates it.
A permission names one action on one kind of resource, such as table:read. Roles grant permissions to users and workload identities. An organization role applies to one Organization. A project role applies to one Project.
A delegated OAuth token can use a permission only when two conditions are true: the user holds the permission, and one of the token's scopes covers it. The Scope column names that scope. "Not delegable" means that no third-party client can use the permission.
Organizations
An organization role grants these permissions on one Organization. The Organizations service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
org:manage-app-access | Not delegable | Decide which third-party apps and MCP clients the organization's users may sign in to. |
org:configure | Not delegable | |
org:invite | Not delegable | |
org:list-users | Not delegable | |
org:manage-users | Not delegable | |
org:list-projects | projects:read | |
org:create-project | Not delegable | |
org:delete-project | Not delegable |
Projects
View and delete a Project, and manage its role grants. The Projects service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
project:view | projects:read | |
project:view-grants | Not delegable | |
project:grant-role | Not delegable | |
project:drop | Not delegable |
Catalog
Read and change the Project Catalog: resources, commits, branches, and tags. The Catalog service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
catalog:initialize | catalog:write | |
catalog:pin | catalog:write | |
catalog:resolve-resources | catalog:read | |
catalog:list-resources | catalog:read | |
catalog:read-snapshot | catalog:read | |
catalog:read-state | catalog:read | |
catalog:publish | catalog:write | |
catalog:read-changes | catalog:read | |
catalog:read-history | catalog:read | |
catalog:resolve-commit | catalog:read | |
catalog:read-commit | catalog:read | |
catalog:list-branches | catalog:read | |
catalog:create-branch | catalog:write | |
catalog:rename-branch | catalog:write | |
catalog:delete-branch | catalog:write | |
catalog:read-reflog | catalog:read | |
catalog:read-ref-events | catalog:read | |
catalog:create-tag | catalog:write | |
catalog:list-tags | catalog:read | |
catalog:merge-bases | catalog:read | |
catalog:compare-commits | catalog:read | |
catalog:diff-state | catalog:read | |
catalog:merge | catalog:write | |
catalog:recover-publication | catalog:write | |
catalog:revert-commit | catalog:write | |
catalog:read-log | catalog:read |
Tables
Create, view, read, and write Tables. The Tables service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
table:create | tables:write | |
table:view | tables:read | |
table:read | tables:read | |
table:write | tables:write |
Vector Indexes
Create, read, and write Vector Indexes. The Vector Indexes service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
vector-index:create | tables:write | |
vector-index:read | tables:read | |
vector-index:write | tables:write |
Locations
Create, view, change, list, read, and drop Locations. The Locations service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
location:create | locations:write | |
location:view | locations:read | |
location:update | locations:write | |
location:drop | locations:write | |
location:list | locations:read | |
location:read | locations:read |
Connections
Manage Connections and use the credentials that they hold. The Connections service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
connection:view | connections:read | |
connection:create | Not delegable | |
connection:update | Not delegable | |
connection:drop | Not delegable | |
connection:bind | Not delegable | Name a Connection from another resource, such as a Location. Checked when the referencing resource is created; readers of that resource need permissions on it alone. |
connection:use | Not delegable | Obtain a vended credential with no binding resource to audit against. |
Storage
Configure Project file systems and mount them. The Storage service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
file-system:update | Not delegable | |
file-system:view | Not delegable | |
file-system:view-mounts | Not delegable | |
file-system:mount-ro | Not delegable | |
file-system:mount-rw | Not delegable | |
file-system:unmount | Not delegable |
Resource mounts and tokens
Manage mounts between resources and mint tokens scoped to one resource. The Resource mounts and tokens service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
resource:manage-mounts | Not delegable | Approve, reject, revoke, or detach resource mounts. |
resource:mint-token | Not delegable | Mint a resource token scoped to the target resource. |
Tasks
Submit, view, cancel, and consume Tasks. The Tasks service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
task:submit | compute:run | |
task:view | compute:read | |
task:cancel | compute:run | |
task:consume | Not delegable |
Worker Pools
View and manage Worker Pools. The Worker Pools service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
worker-pool:view | compute:read | |
worker-pool:manage | Not delegable |
Workloads
Create and view workload identities, and manage their credentials and sign-in policies. The Workloads service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
workload:create | Not delegable | |
workload:view | Not delegable | |
workload:manage-credentials | Not delegable | |
workload:manage-policies | Not delegable |
Applications
View and manage the Applications of a Project. The Applications service checks these permissions.
| Permission | Scope | Description |
|---|---|---|
app:view | Not delegable | See the project's sign-in applications. |
app:manage | Not delegable | Create, change, suspend and delete the project's sign-in applications. |