Project Permissions

Comprehensive guide to Infisical’s project-level permissions

Overview

Infisical’s project permissions system follows a role-based access control (RBAC) model built on a subject-action-object framework. At the project level, these permissions determine what actions users/machines can perform on various resources within a specific project.

Each permission consists of:

• Subject: The resource the permission applies to (e.g., secrets, members, settings)
• Action: The operation that can be performed (e.g., read, create, edit, delete)

Some project-level resources—specifically secrets, secret-folders, secret-imports, dynamic-secrets, and secret-syncs, support conditional permissions and permission inversion for more granular access control. Conditions allow you to specify criteria (like environment, secret path, or tags) that must be met for the permission to apply.

Available Project Permissions

Below is a comprehensive list of all available project-level subjects and their supported actions.

Core Platform & Access Control

Subject: role

Action	Description
read	View project roles and their assigned permissions
create	Create new project roles
edit	Modify existing project roles
delete	Remove project roles

Subject: member

Action	Description
read	View project members
create	Add new members to the project
edit	Modify member details
delete	Remove members from the project
grant-privileges	Change permission levels of project members

Subject: groups

Action	Description
read	View project groups
create	Create new groups within the project
edit	Modify existing groups
delete	Remove groups from the project
grant-privileges	Change permission levels of project groups

Subject: identity

Action	Description
read	View project identities
create	Add new identities to project
edit	Modify project identities
delete	Remove identities from project
grant-privileges	Change permission levels of project identities

Subject: settings

Action	Description
read	View project settings
create	Add new project configuration settings
edit	Modify project settings
delete	Remove project settings

Subject: environments

Action	Description
read	View project environments
create	Add new environments to the project
edit	Modify existing environments
delete	Remove environments from the project

Subject: tags

Action	Description
read	View project tags
create	Create new tags for organizing resources
edit	Modify existing tags
delete	Remove tags from the project

Subject: project

Action	Description
edit	Modify workspace settings
delete	Delete the workspace

Subject: ip-allowlist

Action	Description
read	View IP allowlists
create	Add new IP addresses or ranges to allowlists
edit	Modify existing IP allowlist entries
delete	Remove IP addresses from allowlists

Subject: audit-logs

Action	Description
read	View audit logs of actions performed within the project

Subject: integrations

Action	Description
read	View configured integrations
create	Add new third-party integrations
edit	Modify integration settings
delete	Remove integrations

Subject: webhooks

Action	Description
read	View webhook configurations
create	Add new webhooks
edit	Modify webhook endpoints or triggers
delete	Remove webhooks

Subject: service-tokens

Action	Description
read	View service tokens
create	Create new service tokens for API access
edit	Modify token properties
delete	Revoke or remove service tokens

Subject: app-connections

Supports conditions and permission inversion

Action	Description
read-app-connections	View app connection configurations
create-app-connections	Create new app connections
edit-app-connections	Modify existing app connections
delete-app-connections	Remove app connections
connect-app-connections	Use app connections

Secrets Management

Subject: secrets

Supports conditions and permission inversion

Action	Description	Notes
read	View secrets and their values	This action is the equivalent of granting both describeSecret and readValue. The read action is considered legacy. You should use the describeSecret and/or readValue actions instead.
describeSecret	View secret details such as key, path, metadata, tags, and more	If you are using the API, you can pass viewSecretValue: false to the API call to retrieve secrets without their values.
readValue	View the value of a secret.	In order to read secret values, the describeSecret action must also be granted.
create	Add new secrets to the project
edit	Modify existing secret values
delete	Remove secrets from the project

Subject: secret-folders

Supports conditions and permission inversion

Action	Description
read	View secret folders
create	Create new folders
edit	Modify folder properties
delete	Remove secret folders

Subject: secret-imports

Supports conditions and permission inversion

Action	Description
read	View secret imports
create	Create secret imports
edit	Modify secret imports
delete	Remove secret imports

Subject: secret-events

Action	Description
subscribe-on-created	Subscribe to events when secrets are created
subscribe-on-updated	Subscribe to events when secrets are updated
subscribe-on-deleted	Subscribe to events when secrets are deleted
subscribe-on-import-mutations	Subscribe to events when secrets are modified through imports

Subject: secret-rollback

Action	Description
read	View secret versions and snapshots
create	Roll back secrets to snapshots

Subject: commits

Action	Description
read	View commits and changes across folders
perform-rollback	Roll back commits changes and restore folders to previous state

Subject: secret-approval

Action	Description
read	View approval policies and requests
create	Create new approval policies
edit	Modify approval policies
delete	Remove approval policies
allow-change-bypass	Allow request creators to merge changes without approval in break-glass situations
allow-access-bypass	Allow request creators to access secrets without approval in break-glass situations

Subject: secret-rotation

Supports conditions and permission inversion

Action	Description
read	View secret rotation configurations
read-generated-credentials	View the generated credentials of a rotation
create	Set up secret rotation configurations
edit	Modify secret rotation configurations
rotate-secrets	Rotate the generated credentials of a rotation
delete	Remove secret rotation configurations

Subject: secret-syncs

Supports conditions and permission inversion.

Action	Description
read	View secret synchronization configurations
create	Create new sync configurations
edit	Modify existing sync settings
delete	Remove sync configurations
sync-secrets	Execute synchronization of secrets between systems
import-secrets	Import secrets from sync sources
remove-secrets	Remove secrets from sync destinations

Subject: dynamic-secrets

Supports conditions and permission inversion

Action	Description
read-root-credential	View dynamic secret configurations
create-root-credential	Create dynamic secrets
edit-root-credential	Edit dynamic secrets
delete-root-credential	Remove dynamic secrets
lease	Create dynamic secret leases

Key Management Service (KMS)

Subject: kms

Action	Description
edit	Modify project KMS settings

Subject: cmek

Action	Description
read	View Customer-Managed Encryption Keys
create	Add new encryption keys
edit	Modify key properties
delete	Remove encryption keys
encrypt	Use keys for encryption operations
decrypt	Use keys for decryption operations

Public Key Infrastructure (PKI)

Subject: certificate-authorities

Action	Description
read	View certificate authorities
create	Create new certificate authorities
edit	Modify CA configurations
delete	Remove certificate authorities

Subject: certificates

Action	Description
read	View certificates
read-private-key	Read certificate private key
create	Issue new certificates
delete	Revoke or remove certificates

Subject: certificate-profiles

Action	Description
read	View certificate profiles
create	Create new certificate profiles
edit	Modify profile configurations
delete	Remove certificate profiles
issue-cert	Issue new certificates

Subject: certificate-templates

Action	Description
read	View certificate templates
create	Create new certificate templates
edit	Modify template configurations
delete	Remove certificate templates

Subject: pki-alerts

Action	Description
read	View PKI alert configurations
create	Create new alerts for certificate expiry or other PKI events
edit	Modify alert settings
delete	Remove PKI alerts

Subject: pki-collections

Action	Description
read	View PKI resource collections
create	Create new collections for organizing PKI resources
edit	Modify collection properties
delete	Remove PKI collections

SSH Certificate Management

Subject: ssh-certificate-authorities

Action	Description
read	View SSH certificate authorities
create	Create new SSH certificate authorities
edit	Modify SSH CA configurations
delete	Remove SSH certificate authorities

Subject: ssh-certificates

Action	Description
read	View SSH certificates
create	Issue new SSH certificates
edit	Modify SSH certificate properties
delete	Revoke or remove SSH certificates

Subject: ssh-certificate-templates

Action	Description
read	View SSH certificate templates
create	Create new SSH certificate templates
edit	Modify SSH template configurations
delete	Remove SSH certificate templates

Secret Scanning

Subject: secret-scanning-data-sources

Action	Description
read-data-sources	View Data Sources
create-data-sources	Create new Data Sources
edit-data-sources	Modify Data Sources
delete-data-sources	Remove Data Sources
read-data-source-resources	View Data Source Resources
read-data-source-scans	View Data Source Scans
trigger-data-source-scans	Trigger Data Source Secret Scans

Subject: secret-scanning-findings

Action	Description
read-findings	View Secret Scanning Findings
update-findings	Update Secret Scanning Findings

Subject: secret-scanning-configs

Action	Description
read-configs	View Secret Scanning Project Configuration
update-configs	Update Secret Scanning Project Configuration