Roles & permissions
PIE authorises every operation through six roles. Access is enforced server-side by the RBAC engine (can(principal, action, resource)); the client-side usePermission() hook is UX-only. For PIC roles a grant filter (queryFilter.grantedOrgIds) additionally scopes reads to producers who have granted access — a handful of resources (e.g. quality_profile) are deliberately own-org only.
Each cell lists the actions the role may take on the resource; — means no access.
| Resource | pip_admin | pip_editor | pip_viewer | pic_subscriber | pic_admin | platform_admin | platform_admin_readonly | platform_support | platform_billing |
|---|---|---|---|---|---|---|---|---|---|
ai_enrichment | read, create, accept, reject | read, create, accept, reject | read | — | — | read | read | read | — |
ai_settings | read, update | — | — | — | read, update | read, update | read | read | — |
analytics | read, export | read, export | read, export | — | — | read | read | read | — |
api_key | read, create, delete, manage_api_keys | — | — | — | read, create, delete, manage_api_keys | read, delete | read | read | — |
audit_log | read, view_audit | — | — | — | read, view_audit | read, view_audit | read, view_audit | read, view_audit | — |
auth_policy | read, update | — | — | — | read, update | — | — | — | — |
billing | read | — | — | — | read | read, create, update, delete | read | — | read, create, update, delete |
brand_portal | read, create, update, delete, publish | read | read | — | — | read | read | read | — |
catalog_render | read, create | read, create | read | — | — | read | read | read | — |
catalog_template | read, create, update, delete | read, create, update, delete | read | — | — | read | read | read | — |
channel | read, create, update, delete | read | read | — | — | read | read | read | — |
channel_publication | read, publish | read, publish | read | — | — | read | read | read | — |
connector | read, create, update, delete, test | read | read | — | — | read | read | read | — |
consent | read, update | — | — | — | read, update | read | read | read | — |
data_subject_request | read, create | — | — | — | read, create | read, create | read | read, create | — |
gdsn_connection | read, create, update, delete | read | read | — | — | read | read | read | — |
gdsn_inbound | — | — | — | read, accept, reject | read, accept, reject | read | read | read | — |
gdsn_message | read | read | read | — | — | read | read | read | — |
gdsn_publication | read, create | read, create | read | — | — | read | read | read | — |
grant | read, create, delete, manage_grants | read | read | read | read | read, create, delete, manage_grants | read | read | — |
gs1_mapping | read, create, update, delete | read | read | — | — | read | read | read | — |
impersonation | — | — | — | — | — | create | — | create | — |
mapping_template | — | — | — | read | read, create, update, delete | read | read | read | — |
onboarding_request | — | — | — | read | read, create, update, delete | read | read | read | — |
onboarding_submission | — | — | — | read | read, update, approve, reject | read | read | read | — |
org | read, update | read | read | read | read, update | read, create, update, delete | read | read | read |
platform_admin_users | — | — | — | — | — | read, create, update, delete, manage_users | — | — | — |
processing_record | read, create, update, delete | — | — | — | read, create, update, delete | read | read | read | — |
product | read, create, update, delete, publish, archive | read, create, update, publish | read | read | read | read | read | read | — |
product_asset | read, create, update, delete | read, create, update, delete | read | read | read | read | read | read | — |
product_category | read, create, update, delete | read | read | read | read | read | read | read | — |
product_passport | read, create, update, delete, publish, submit, export | read, create, update, delete, publish, export | read, export | — | — | read | read | read | — |
product_relationship | read, create, update, delete | read, create, update, delete | read | read | read | read | read | read | — |
quality_profile | read, create, update, delete | read | read | read | read, create, update, delete | read | read | read | — |
reference_entity | read, create, update, delete | read, create, update, delete | read | read | read | read | read | read | — |
reference_entity_type | read, create, update, delete | read | read | read | read | read, create, update, delete | read | read | — |
registry_credentials | read, update | — | — | — | — | read | read | read | — |
rendition_preset | read, create, update, delete | read | read | — | — | read | read | read | — |
retention_policy | read, create, update, delete | — | — | — | read, create, update, delete | read, create, update, delete | read | read | — |
sso_connection | read, create, update, delete, test | — | — | — | read, create, update, delete, test | read | read | — | — |
tenant_assist | — | — | — | — | — | create | — | create | — |
user | read, create, update, delete, manage_users | read | read | read | read, create, update, delete, manage_users | read, create, update, delete, manage_users | read | read | — |
webhook | read, create, update, delete | read | — | read, create, update, delete | read, create, update, delete | read | read | read | — |
workflow | read, create, update, delete | read | read | — | — | read | read | read | — |
workflow_instance | read, update | read, update | read | — | — | read | read | read | — |