Flightdeck role and access matrix
Use this matrix to decide which platform role a Flightdeck operator needs. DVARA separates cross-workspace platform roles from workspace roles, and separates read access from permission to change data.
Not included in DVARA Open Source.
Understand the two role scopes
Platform roles use platform-wide Flightdeck navigation across workspaces:
owneradministers the platform and can perform high-impact changes.policy-adminoperates routing and governance controls.billing-adminoperates cost and billing controls.
Workspace roles use workspace-scoped Flightdeck navigation:
adminmanages one workspace and its team.developeruses the workspace's development surfaces.viewerhas read-only workspace access.
One account cannot mix platform and workspace roles. The values above are the literal role names in built-in, OIDC, and SAML role claims.
Check platform-wide page access
Read means the page is reachable and visible. Change means the role can use
its state-changing actions. A dash means the page is hidden and the URL is
refused.
| Platform destination | owner | policy-admin | billing-admin |
|---|---|---|---|
| Dashboard | Read | Read | Read |
| Playground | Change | — | — |
| Workspaces | Change | Read | Read |
| Teams and team limits | Change | Read | Read |
| Accounts | Change | Read | Read |
| Users | Change | — | — |
| Provider credentials | Change | — | — |
| Routes | Change | Change | — |
| Latency | Read | Read | — |
| Output schemas | Change | Change | — |
| Semantic cache | Change | — | — |
| Policies | Change | Change | — |
| Guardrail plugins | Change | Change except secret rotation | — |
| PII and data protection | Change | Change except purge | — |
| Audit | Read | Read | Read |
| Compliance reports | Change and delete | Read | Generate and read |
| Webhooks | Change | Change | Read |
| Cost dashboard | Read | — | Read |
| Budget caps | Change | — | Change |
| Model pricing | Change | Read | Change |
| Chargeback reports | Change | — | Change |
| Prompt templates | Change | Read | Read |
| Prompt experiments | Change | Read | Read |
| Golden prompts and evals | Change | Read | Read |
| MCP servers, sessions, and tool calls (from 1.8.5 including Kill a session by id) | Change | Change | — |
| MCP analytics | Read | Read | Read |
| A2A agents, sessions, conversations, traffic, and analytics | Change | Change | — |
| Licence details | Change | Read | Read |
| Import and export configuration | Change | — | — |
Some forms can impose a narrower rule than their page. For example, only an
owner can rotate a guardrail-plugin secret, purge PII data, delete a compliance
report, manage users or credentials, or import configuration. Do not infer write
permission from the ability to open a page.
Apply the additional capability gates
Role permission is necessary but not always sufficient:
- Sensitive governance changes: activating a policy, creating or materially changing a budget, exporting audit evidence, and revealing or purging PII require a different authorized person to approve the exact action. Both participants still need the capability and scope shown in this matrix. The approval gate does not turn a read-only role into a writer.
- MCP and A2A: their Flightdeck destinations and the shared approval queue need no licence. From 1.8.2 both planes run on every Enterprise install, so the role decides access.
- Playground: the page is present only when
dvara.flightdeck.playground.enabled=true, which is the default. Platform scope remainsowner-only. Workspaceadminanddeveloperroles use the workspace-scoped page. - Managed-service billing: workspace billing pages exist only in the managed service. They are not a self-hosted Flightdeck destination.
Check workspace access
Workspace roles do not receive cross-workspace navigation. Flightdeck scopes their access to the active workspace:
| Workspace concern | admin | developer | viewer |
|---|---|---|---|
| Dashboard, API keys, credentials, policies, audit, usage, prompts, and reports | Reachable; write ability depends on the operation | Reachable; write ability depends on the operation | Read-only surfaces only |
| Team management and workspace deletion | Change | — | — |
| MCP extension allow-list (from 1.8.4) | Change | — | — |
| MCP session kill, also by session ID (by ID from 1.8.5) | Change | Change | — |
| MCP and A2A size limits (from 1.8.5; the platform owner sets them in Flightdeck) | Read | — | — |
| Playground | Use | Use | — |
| Personal access tokens | Manage own tokens | Manage own tokens | Manage own tokens |
The broad workspace URL rule requires authentication; controllers apply workspace scope and operation-specific write checks. Use the workspace team and access guide for the task-level matrix instead of treating every reachable workspace page as writable.
Verify a role before rollout
Test each external identity provider role mapping with a non-production user:
- Sign in and confirm Flightdeck shows the platform-wide or workspace-scoped navigation expected for the role scope.
- Open one allowed page and one refused URL directly; hidden navigation alone is not a security test.
- Test one allowed write and one refused write on a shared read page.
- Confirm the refusal is recorded when authentication or audit storage is configured to retain it.
See Setup and login for built-in, OIDC, and SAML configuration.