Groups
In Red Kite, permissions are not given to users directly: they are given to groups, and users are members of groups. A user has the permissions of all the groups they are a member of.
A group defines:
- Members: the users of the group.
- Scopes: the permissions of the group, such as reading domains (
resources:domains:read) or creating jobs (automation:custom-jobs:create). Scopes are organized in a tree: a parent such asresources:*covers all the scopes below it. - Projects: the projects on which the permissions apply. Either all projects, or selected projects only.
Default groups
| Group | Projects | Description |
|---|---|---|
| admins | All projects | Has full control over the application. |
| users | All projects | Can only use the application, but cannot configure. |
| read-only | All projects | Can only read data, not edit. |
The admins group is read-only: it cannot be edited or deleted, and Red Kite always keeps at least one admin.
When creating a group, you can start from a template: the default groups, plus project contributor (can add and update data in the selected projects) and project read-only (can read data in the selected projects).
"Your own" and "everyone's"
Some actions exist in two scopes: one for your own items, and one ending with -all for everyone's. For instance, every user can update
their own profile with manage:users:update, but only manage:users:update-all allows updating other users. The -all scopes are
given to administrators only by default.
To manage groups, see Managing roles and permissions.