> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization permissions

> Comprehensive guide to Infisical's organization-level permissions

## Overview

Infisical's organization permissions system follows a role-based access control (RBAC) model built on a subject-action-object framework. At the organization level, these permissions determine what actions users/machines can perform on various resources across the entire organization.

Each permission consists of:

* **Subject**: The resource the permission applies to (e.g., project, members, billing)
* **Action**: The operation that can be performed (e.g., read, create, edit, delete)

Some organization-level resources—specifically `app-connections`—support conditional permissions and permission inversion for more granular access control.

## Available organization permissions

Below is a comprehensive list of all available organization-level subjects and their supported actions, organized by functional area.

### Project management

#### Subject: `project` (formerly workspace)

| Action | Description |
| - | - |
| `create` | Create new project |
| `request-access` | Request access to projects |

#### Subject: `sub-organization`

| Action | Description |
| - | - |
| `create` | Create new sub-organizations under the root organization |
| `edit` | Modify existing sub-organizations (e.g., rename, change slug) |
| `delete` | Remove sub-organizations from the root organization |
| `direct-access` | Access and switch into sub-organizations the user has membership in |
| `link-group` | Link a root organization group to a sub-organization (and unlink it). Root org role only. |

### Role management

#### Subject: `role`

| Action | Description |
| - | - |
| `read` | View organization roles and their assigned permissions |
| `create` | Create new organization roles |
| `edit` | Modify existing organization roles |
| `delete` | Remove organization roles |

### User management

#### Subject: `member`

| Action | Description |
| - | - |
| `read` | View organization members |
| `create` | Add new members to the organization |
| `edit` | Modify member attributes and activation status |
| `delete` | Remove members from the organization |
| `grant-privileges` | Change the roles held by organization members |

#### Subject: `groups`

| Action | Description |
| - | - |
| `read` | View organization groups |
| `create` | Create new groups in the organization |
| `edit` | Modify existing groups |
| `delete` | Remove groups from the organization |
| `grant-privileges` | Change permission levels for organization groups |
| `add-identities` | Add identities to groups |
| `add-members` | Add members to groups |
| `remove-members` | Remove members from groups |
| `remove-identities` | Remove identities from groups |

#### Subject: `identity`

| Action | Description |
| - | - |
| `read` | View organization identities |
| `create` | Add new identities to organization |
| `edit` | Modify organization identities |
| `delete` | Remove identities from organization |
| `grant-privileges` | Change permission levels of organization identities |
| `revoke-auth` | Revoke authentication for identities |
| `edit-auth` | Modify authentication methods for identities |
| `create-token` | Create new authentication tokens |
| `delete-token` | Delete authentication tokens |
| `get-token` | Retrieve authentication tokens |

### Security & compliance

#### Subject: `secret-scanning`

| Action | Description |
| - | - |
| `read` | View secret scanning results and settings |
| `create` | Configure secret scanning |
| `edit` | Modify secret scanning settings |
| `delete` | Remove secret scanning configuration |

#### Subject: `settings`

| Action | Description |
| - | - |
| `read` | View organization settings |
| `create` | Setup and configure organization settings |
| `edit` | Modify organization settings |
| `delete` | Remove organization settings |

#### Subject: `incident-contact`

| Action | Description |
| - | - |
| `read` | View incident contacts |
| `create` | Set up new incident contacts |
| `edit` | Modify incident contact settings |
| `delete` | Remove incident contacts |

#### Subject: `audit-logs`

| Action | Description |
| - | - |
| `read` | View organization audit logs |
| `edit` | Choose which audit log event classes the organization records |

#### Subject: `email-domains`

| Action | Description |
| - | - |
| `read` | View configured email domains |
| `create` | Add new email domains to the organization |
| `verify-domain` | Verify ownership of an email domain |
| `delete` | Remove email domains |

### Identity provider integration

#### Subject: `sso`

| Action | Description |
| - | - |
| `read` | View Single Sign-On configurations |
| `create` | Set up new SSO integrations |
| `edit` | Modify existing SSO settings |
| `delete` | Remove SSO configurations |
| `bypass-sso-enforcement` | Bypass enforced SSO at login (break-glass) when the organization has "Allow admins to bypass SSO" enabled. Can be granted to custom roles to allow non-admin users to use break-glass access. |

#### Subject: `scim`

| Action | Description |
| - | - |
| `read` | View SCIM configurations |
| `create` | Set up new SCIM provisioning |
| `edit` | Modify existing SCIM settings |
| `delete` | Remove SCIM configurations |

#### Subject: `ldap`

| Action | Description |
| - | - |
| `read` | View LDAP configurations |
| `create` | Set up new LDAP integrations |
| `edit` | Modify existing LDAP settings |
| `delete` | Remove LDAP configurations |

#### Subject: `github-org-sync`

| Action | Description |
| - | - |
| `read` | View GitHub organization sync settings |
| `create` | Set up GitHub organization sync |
| `edit` | Modify GitHub organization sync settings |
| `delete` | Remove GitHub organization sync |

### Billing & subscriptions

#### Subject: `billing`

| Action | Description |
| - | - |
| `read` | View billing information and subscription status |
| `manage-billing` | Manage billing details and subscription plans |

### Templates & automation

#### Subject: `project-templates`

| Action | Description |
| - | - |
| `read` | View project templates |
| `create` | Create new project templates |
| `edit` | Modify existing project templates |
| `delete` | Remove project templates |

### Integrations

#### Subject: `app-connections`

Supports conditions and permission inversion

| Action | Description |
| - | - |
| `read` | View app connection configurations |
| `create` | Create new app connections |
| `edit` | Modify existing app connections |
| `delete` | Remove app connections |
| `connect` | Use app connections |
| `rotate-credentials` | Rotate app connection credentials |

### Key management

#### Subject: `kms`

| Action | Description |
| - | - |
| `read` | View organization KMS configurations |
| `create` | Set up new KMS configurations |
| `edit` | Modify KMS settings |
| `delete` | Remove KMS configurations |

#### Subject: `kmip-server`

| Action | Description |
| - | - |
| `list-kmip-servers` | View organization KMIP servers |
| `create-kmip-servers` | Create new KMIP servers |
| `edit-kmip-servers` | Modify KMIP server settings and authentication |
| `delete-kmip-servers` | Remove KMIP servers from the organization |
| `revoke-kmip-server-access` | Revoke a KMIP server's access and invalidate its tokens |

### Honey tokens

#### Subject: `honey-tokens`

| Action | Description |
| - | - |
| `setup` | Set up and configure honey tokens |

### Insights

#### Subject: `secrets-management-insights`

| Action | Description |
| - | - |
| `read` | View secrets management insights |
| `generate-report` | Generate new secrets management insight reports |
| `delete-report` | Delete secrets management insight reports |
| `search-all-secret-values` | Find secrets that share a value in any project, including projects the user isn't a member of |

### Admin tools

#### Subject: `organization-admin-console`

| Action | Description |
| - | - |
| `access-all-projects` | Access all projects within the organization |

### Secure share

#### Subject: `secret-share`

| Action | Description |
| - | - |
| `manage-settings` | Manage secret share settings |

### Gateway management

#### Subject: `gateway`

| Action | Description |
| - | - |
| `list-gateways` | View all organization gateways |
| `create-gateways` | Add new gateways to organization |
| `edit-gateways` | Modify existing gateway settings |
| `delete-gateways` | Remove gateways from organization |
| `attach-gateways` | Attach gateways to resources |
| `revoke-gateway-access` | Disconnect a running gateway and invalidate enrollment tokens |

#### Subject: `gateway-pool`

| Action | Description |
| - | - |
| `list-gateway-pools` | View all organization gateway pools |
| `create-gateway-pools` | Add new gateway pools to organization |
| `edit-gateway-pools` | Modify pool settings and manage pool gateways |
| `delete-gateway-pools` | Remove gateway pools from organization |
| `attach-gateway-pools` | Attach gateway pools to consumer configs |

#### Subject: `relay`

| Action | Description |
| - | - |
| `list-relays` | View all organization relays |
| `create-relays` | Add new relays to organization |
| `edit-relays` | Modify existing relay settings |
| `delete-relays` | Remove relays from organization |
| `revoke-relay-access` | Revoke relay access and invalidate tokens |

#### Subject: `machine-identity-auth-template`

| Action | Description |
| - | - |
| `list-templates` | View identity auth templates |
| `create-templates` | Create new identity auth templates |
| `edit-templates` | Modify existing identity auth templates |
| `delete-templates` | Remove identity auth templates |
| `unlink-templates` | Unlink identity auth templates from identities |
| `attach-templates` | Attach identity auth templates to identities |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.