Private control-plane capability keys.
RBAC
Roles, Permissions & Grants
Visual RBAC matrix derived from the v4 contracts: 5 roles, 33 permissions and critical action guardrails.
Roles5Permissions33Guardrails6
Product/workspace capability keys.
Memory retrieval and search surface.
Full access baseline for the owner role.
Roles
Human roles and scope from CONTRACTS_V4.yaml.
Ownerowner
Controllo totale di dominio tecnico e prodotto.
Can
Tutte le viste, azioni sensibili, policy publish, risk review, model config e workspace.
Cannot
Nessun limite funzionale; doppia conferma e audit trail sui comandi ad alto impatto.
Ops Adminops_admin
Gestione operativa del control plane privato.
Can
Agenti, jobs, monitor, log, rischio, memoria, policy e azioni operative consentite.
Cannot
Niente billing cliente o token workspace.
Analyst Internalanalyst_internal
Lettura interna e uso analitico del prodotto.
Can
Overview, memory, policy, audit e superfici Natapulse in modalità analitica.
Cannot
Nessuna azione distruttiva su agenti, job, policy, modelli o membership.
Client Adminclient_admin
Amministratore workspace Natapulse.
Can
Watchlists, alert, membri, token e preferenze del proprio workspace.
Cannot
Nessun accesso a dashboard tecnica privata.
Client Userclient_user
Consumo prodotto con azioni limitate.
Can
Leggere feed/report/eventi, usare chat e gestire watchlist/alert consentiti.
Cannot
Niente membership, token o superfici del control plane.
Critical action guardrails
Protected mutations requiring additional safety steps.
ops.policy.publishguardrail
Doppia conferma + commento obbligatorio + audit trail.
ops.risk.reviewguardrail
Motivazione obbligatoria per score 7-10 e chiusura rischio.
ops.agents.operateguardrail
Retry, cancel e pause solo con trace_id e motivo visibile nel log.
ops.jobs.operateguardrail
Cancel irreversibile protetto da confirm step e validazione stato.
ops.models.configureguardrail
Prod only con snapshot config precedente e rollback disponibile.
pulse.workspace.tokens.manageguardrail
Visualizzazione parziale token, rotazione one-click, audit completo.
Permissions catalog
Permission keys and domains.
| Permission | Domain | Description |
|---|---|---|
| ops.overview.read | ops | Lettura KPI, incidenti, queue depth e salute complessiva. |
| ops.agents.read | ops | Lettura stato agenti, run, heartbeat e dettaglio. |
| ops.agents.operate | ops | Pausa, resume e retry policy-safe sugli agenti. |
| ops.jobs.read | ops | Lettura code, backlog, payload essenziale e cronologia job. |
| ops.jobs.operate | ops | Retry, cancel, reprioritize e unblock dei job. |
| ops.memory.read | memory | Ricerca e retrieve bundle su memoria raw/curated/decision. |
| ops.logs.read | ops | Lettura stream e query log tecnici. |
| ops.policy.read | ops | Lettura policy attive, versioni e diff. |
| ops.policy.publish | ops | Creazione versione policy, attivazione e archiviazione. |
| ops.risk.read | ops | Lettura registro rischi e trend. |
| ops.risk.review | ops | Cambio score/stato/owner e review formale rischio. |
| ops.monitor.read | ops | Lettura host, servizi, metriche e processi. |
| ops.models.read | ops | Lettura stato modelli, fallback e saturazione. |
| ops.models.configure | ops | Cambio configurazione modelli e routing operativo. |
| ops.audit.read | ops | Lettura audit trail, decision log e rollback history. |
| pulse.live.read | pulse | Accesso al feed Live Pulse e cluster eventi. |
| pulse.events.read | pulse | Accesso al dettaglio evento e fonti correlate. |
| pulse.reports.read | pulse | Accesso ai report generati e archiviati. |
| pulse.reports.generate | pulse | Generazione report catch-up, event, theme, ticker/coin. |
| pulse.social.read | pulse | Accesso a Social Radar. |
| pulse.filings.read | pulse | Accesso a Filings Desk. |
| pulse.market.read | pulse | Accesso a Market Desk. |
| pulse.onchain.read | pulse | Accesso a On-chain Desk. |
| pulse.watchlists.read | pulse | Lettura watchlist e feed associato. |
| pulse.watchlists.manage | pulse | Creazione e modifica watchlist. |
| pulse.wallets.read | pulse | Accesso a Wallet Intelligence e wallet profile. |
| pulse.chat.ask | pulse | Invio query e uso del canale chat/analyst. |
| pulse.alerts.read | pulse | Lettura regole alert e consegne. |
| pulse.alerts.manage | pulse | Creazione, modifica e pausa alert. |
| pulse.settings.read | pulse | Lettura preferenze profilo/workspace. |
| pulse.settings.manage_self | pulse | Aggiornamento preferenze utente/workspace. |
| pulse.workspace.members.manage | pulse | Gestione membri e ruoli del workspace. |
| pulse.workspace.tokens.manage | pulse | Rotazione token applicativi/API del workspace. |
Role grants matrix
Role-to-permission grants from CONTRACTS_V4.yaml.
| Permission | owner | ops_admin | analyst_internal | client_admin | client_user |
|---|---|---|---|---|---|
| ops.overview.read | Y | Y | Y | - | - |
| ops.agents.read | Y | Y | Y | - | - |
| ops.agents.operate | Y | Y | - | - | - |
| ops.jobs.read | Y | Y | Y | - | - |
| ops.jobs.operate | Y | Y | - | - | - |
| ops.memory.read | Y | Y | Y | - | - |
| ops.logs.read | Y | Y | - | - | - |
| ops.policy.read | Y | Y | Y | - | - |
| ops.policy.publish | Y | Y | - | - | - |
| ops.risk.read | Y | Y | Y | - | - |
| ops.risk.review | Y | Y | - | - | - |
| ops.monitor.read | Y | Y | Y | - | - |
| ops.models.read | Y | Y | Y | - | - |
| ops.models.configure | Y | Y | - | - | - |
| ops.audit.read | Y | Y | Y | - | - |
| pulse.live.read | Y | Y | Y | Y | Y |
| pulse.events.read | Y | Y | Y | Y | Y |
| pulse.reports.read | Y | Y | Y | Y | Y |
| pulse.reports.generate | Y | Y | Y | Y | Y |
| pulse.social.read | Y | Y | Y | Y | Y |
| pulse.filings.read | Y | Y | Y | Y | Y |
| pulse.market.read | Y | Y | Y | Y | Y |
| pulse.onchain.read | Y | Y | Y | Y | Y |
| pulse.watchlists.read | Y | Y | Y | Y | Y |
| pulse.watchlists.manage | Y | - | - | Y | Y |
| pulse.wallets.read | Y | Y | Y | Y | Y |
| pulse.chat.ask | Y | Y | Y | Y | Y |
| pulse.alerts.read | Y | Y | Y | Y | Y |
| pulse.alerts.manage | Y | - | - | Y | Y |
| pulse.settings.read | Y | Y | Y | Y | Y |
| pulse.settings.manage_self | Y | - | - | Y | Y |
| pulse.workspace.members.manage | Y | - | - | Y | - |
| pulse.workspace.tokens.manage | Y | - | - | Y | - |