Flightdeck role and access matrix
Use this matrix to decide which platform role a Flightdeck operator needs. DVARA separates cross-workspace platform roles from workspace roles, and separates read access from permission to change data.
Not included in DVARA Open Source.
Understand the two role scopes
Platform roles use platform-wide Flightdeck navigation across workspaces:
owneradministers the platform and can perform high-impact changes.policy-adminoperates routing and governance controls.billing-adminoperates cost and billing controls.
Workspace roles use workspace-scoped Flightdeck navigation:
adminmanages one workspace and its team.developeruses the workspace's development surfaces.viewerhas read-only workspace access.
One account cannot mix platform and workspace roles. The values above are the literal role names in built-in, OIDC, and SAML role claims.
Check platform-wide page access
Read means the page is reachable and visible. Change means the role can use
its state-changing actions. A dash means the page is hidden and the URL is
refused.
| Platform destination | owner | policy-admin | billing-admin |
|---|---|---|---|
| Dashboard | Read | Read | Read |
| System Status | Read | Read | Read |
| Playground | Change | — | — |
| Workspaces | Change | Read | Read |
| Teams and team limits | Change | Read | Read |
| Accounts | Change | Read | Read |
| Users | Change | — | — |
| Provider credentials | Change | — | — |
| Providers | Change | — | — |
| Gateway enrolment | Change | — | — |
| Routes | Change | Change | — |
| Latency | Read | Read | — |
| Resilience | Change | Change | — |
| Output schemas | Change | Change | — |
| Response cache (each workspace's, on its edit page) | Change | — | — |
| Policies | Change | Change | — |
| Models | Change | Change | — |
| Guardrail plugins | Change | Change except secret rotation | — |
| PII and data protection | Change | Change except purge | — |
| Audit | Read | Read | Read |
| Approvals | Read and decide | Read and decide (not budget changes) | Read and decide budget changes |
| Compliance reports | Change and delete | Read | Generate and read |
| Webhooks | Change | Change | Read |
| Cost dashboard | Read | — | Read |
| Token usage (raw records, from the Cost dashboard) | Read | — | Read |
| Usage-report export | Read | — | Read |
| Credential lookup (which workspace holds a key; token usage, MCP tool calls, A2A traffic) | Read | — | — |
| Budget caps | Change | — | Change |
| Model pricing | Change | Read | Change |
| Token calculator | Read | — | Read |
| Chargeback reports | Change | — | Change |
| Cost Advisor | Apply and dismiss | — | Read and dismiss |
| Billing (managed service only) | Change | — | Change |
| Prompt templates | Change | Read | Read |
| Prompt experiments | Change | Read | Read |
| Golden prompts and evals | Change | Read | Read |
MCP servers, sessions, and tool calls (from 1.8.5 including Kill a session by id; the per-credential lookup is owner only) | Change | Change | — |
| MCP virtual servers and tasks | Change | Change | — |
| MCP tool scope and shadow servers | Read | Read | — |
| MCP analytics | Read | Read | Read |
| MCP catalog (when the catalog is on) | Change | — | — |
A2A agents, sessions, conversations, traffic, and analytics (the per-credential lookup is owner only) | Change | Change | — |
| A2A revocations | Change | Change | — |
| A2A catalog (when the catalog is on) and card signing | Change | — | — |
| Licence details | Change | Read | Read |
| Import and export configuration | Change | — | — |
| Mock scenarios (when the editor is on) | Change | — | — |
| Personal access tokens | Manage own | Manage own | Manage own |
| Notifications, saved views, and search | Use own | Use own | Use own |
Some forms can impose a narrower rule than their page. For example, only an
owner can rotate a guardrail-plugin secret, purge PII data, delete a compliance
report, manage users or credentials, or import configuration. Do not infer write
permission from the ability to open a page.
Apply the additional capability gates
Role permission is necessary but not always sufficient:
- Sensitive governance changes: activating a policy; turning off, changing, rolling back or deleting an active policy; creating or materially changing a budget, exporting audit evidence, and revealing or purging PII require a different authorized person to approve the exact action. Both participants still need the capability and scope shown in this matrix. The approval gate does not turn a read-only role into a writer.
- MCP and A2A: their Flightdeck destinations and the shared approval queue need no licence. From 1.8.2 both planes run on every Enterprise install, so the role decides access.
- Playground: the page is present only when
dvara.flightdeck.playground.enabled=true, which is the default. Platform scope remainsowner-only. Workspaceadminanddeveloperroles use the workspace-scoped page. - Managed-service billing: the Billing pages exist only in the managed
service: the platform page for
ownerandbilling-admin, and the workspace page for a workspaceadmin. They are not a self-hosted Flightdeck destination.
Check workspace access
Workspace roles do not receive cross-workspace navigation. Flightdeck scopes their access to the active workspace:
| Workspace concern | admin | developer | viewer |
|---|---|---|---|
| Dashboard, API keys, credentials, policies, audit, usage, prompts, and reports | Reachable; write ability depends on the operation | Reachable; write ability depends on the operation | Read-only surfaces only |
| Team management and workspace deletion | Change | — | — |
| MCP extension allow-list (from 1.8.4) | Change | — | — |
| MCP session kill, also by session ID (by ID from 1.8.5) | Change | Change | — |
| MCP and A2A size limits (from 1.8.5; the platform owner sets them in Flightdeck) | Read | — | — |
| Playground | Use | Use | — |
| Personal access tokens | Manage own tokens | Manage own tokens | Manage own tokens |
| API keys | Create, revoke, set loop guard and acts-as agent | Create | Read |
| Models | Change | Read | Read |
| Data protection | Change | — | — |
| Response cache | Change | — | — |
| Token usage (raw records) | Read | Read (no menu link; open /token-usage) | Read (no menu link; open /token-usage) |
| Budget caps | Change | Read | Read |
| Cost Advisor | Apply and dismiss | — | — |
| Billing (managed service only) | Change | — | — |
| MCP virtual servers | Create, change and delete | Create and change | Read |
| MCP task cancel | Change | — | — |
| MCP sampling, MCP new tools, and A2A delegation | Change | — | — |
| A2A revocations | Change | Read | Read |
The broad workspace URL rule requires authentication; controllers apply workspace scope and operation-specific write checks. Use the workspace team and access guide for the task-level matrix instead of treating every reachable workspace page as writable.
Verify a role before rollout
Test each external identity provider role mapping with a non-production user:
- Sign in and confirm Flightdeck shows the platform-wide or workspace-scoped navigation expected for the role scope.
- Open one allowed page and one refused URL directly; hidden navigation alone is not a security test.
- Test one allowed write and one refused write on a shared read page.
- Confirm the refusal is recorded when authentication or audit storage is configured to retain it.
See Setup and login for built-in, OIDC, and SAML configuration.