RBAC permission matrix

Ticketra uses granular, action-level permissions. The catalog below is generated from api/src/modules/roles/index.ts. Built-in role columns are sourced from the live database (post-migrations).

Custom roles can be assigned any subset of these permissions. SUPER_ADMIN always implies every permission.

Users

Permission	Action	Super Admin	Admin	User
Create users	users:create	✅	—	—
Disable users	users:disable	✅	—	—
Reset user passwords	users:reset_password	✅	—	—
Change own password	users:change_own_password	✅	✅	✅

Schemas

Permission	Action	Super Admin	Admin	User
Create schemas	schemas:create	✅	—	—
Edit draft schemas	schemas:edit_draft	✅	—	—
Publish schemas	schemas:publish	✅	—	—
Deprecate schemas	schemas:deprecate	✅	—	—
View schemas	schemas:read	✅	✅	✅

Logs

Permission	Action	Super Admin	Admin	User
Submit logs	logs:submit	✅	✅	✅
View ingestion errors	logs:view_errors	✅	✅	—
Search logs	logs:search	✅	✅	✅

Cases

Permission	Action	Super Admin	Admin	User
View cases	cases:read	✅	✅	✅
Create cases	cases:create	✅	✅	✅
Update own cases	cases:update	✅	✅	✅
Update any case	cases:update_any	✅	✅	—
Assign cases	cases:assign	✅	✅	—
Delete cases	cases:delete	✅	—	—
Close cases	cases:close	✅	✅	—
Reopen cases	cases:reopen	✅	✅	—
Link events to cases	cases:link_event	✅	✅	✅

Observables

Permission	Action	Super Admin	Admin	User
View observables	observables:read	✅	✅	✅
Tag observables	observables:tag	✅	✅	✅
Enrich observables	observables:enrich	✅	✅	—

Audit

Permission	Action	Super Admin	Admin	User
View audit log	audit:read	✅	✅	—
View error log	errors:read	✅	—	—

Config

Permission	Action	Super Admin	Admin	User
Modify configuration	config:modify	✅	—	—
View configuration	config:read	✅	✅	—

Integrations

Permission	Action	Super Admin	Admin	User
View integrations	integration:read	✅	✅	—
Modify integrations	integration:modify	✅	—	—

Milestones

Permission	Action	Super Admin	Admin	User
View milestones	milestones:read	✅	✅	✅
Manage milestones	milestones:manage	✅	✅	—

Playbooks

Permission	Action	Super Admin	Admin	User
View playbooks	playbooks:read	✅	✅	✅
Manage playbooks	playbooks:manage	✅	✅	—
Apply playbooks	playbooks:apply	✅	✅	✅

Backup

Permission	Action	Super Admin	Admin	User
Create backups	backup:create	✅	—	—
View backups	backup:read	✅	✅	—
Restore backups	backup:restore	✅	—	—
Delete backups	backup:delete	✅	—	—
Download backups	backup:download	✅	—	—

Alerts

Permission	Action	Super Admin	Admin	User
View alerts	alerts:read	✅	✅	✅
Triage alerts (acknowledge, dismiss, link)	alerts:triage	✅	✅	✅

Reports

Permission	Action	Super Admin	Admin	User
View and download reports	reports:read	✅	✅	✅
Generate reports	reports:generate	✅	✅	✅
Delete reports	reports:delete	✅	✅	—

LDAP

Permission	Action	Super Admin	Admin	User
Manage LDAP configuration	ldap:manage	✅	—	—

Roles

Permission	Action	Super Admin	Admin	User
Manage roles	roles:manage	✅	—	—