# RBAC (Role-Based Access Control) Source: https://docs.chain.link/chainlink-platform/rbac Last Updated: 2026-10-26 > For the complete documentation index, see [llms.txt](/llms.txt). Role-based access control (RBAC) determines what each member of your organization can do on the Chainlink Platform. This page describes the roles available for each product, what each role can do, and how to manage roles for your organization members. ## How RBAC works Each organization member is assigned a role for each product. The role determines the permissions the member has for that product. For example, a member can be a CRE Admin and an ACE Viewer at the same time. - A member can hold a different role for each product. - A member can have no role for a product. A member without a role for a product has no access to that product. - Roles are managed per product. A member's role for one product does not affect their access to other products. ## The Owner role The first user to create an organization is automatically assigned the Owner role. The Owner role includes every permission for every product, including all future products. This covers: - Managing members and their roles for every product - Creating and managing API keys - Managing organization settings, billing, and addresses There is exactly one Owner per organization, and the Owner role cannot be transferred. ## Roles and permissions Each product section below starts with a summary of its roles, followed by a table of the permissions each role includes. A check mark indicates that the role includes the permission. The Owner role includes every permission in every table. ### Reading permission IDs Each permission has an ID in the format `product:resource:action`. You see these IDs when you choose API key permissions, and in error messages when a request is missing a permission. Most IDs follow the same few patterns: - **`read`** permissions let you view a resource. **`write`** permissions let you create and update it. - **`archive:write`** permissions let you archive a resource. Archiving is separate from `write` because archiving some resources also affects everything built on them. For this reason, some roles can create and update a resource but not archive it. - A suffix after a slash limits a permission to one scope. For example, `platform:member_role:write/cre` allows changing CRE roles only, and `platform:member_role:write/*` allows changing roles for every product. - Permissions that start with `platform:` but end with a product scope, such as `platform:limits:write/cre`, are organization-level permissions limited to that product. They appear in that product's table. ### Chainlink Platform Chainlink Platform roles control access to organization-level features such as members, API keys, addresses, billing, and limits. Every member has a Platform role. | Role | Description | | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Full access to manage the Chainlink Platform for your organization: invite and remove members, change any member's roles, and manage API keys. | | User | For developers and operations team members. Can view organization information and members, and can view and create API keys. | | Permission | Description | Admin | User | | -------------------------------- | ----------------------------------------------------------------- | ----- | ---- | | `platform:organization:read` | View organization information. | ✓ | ✓ | | `platform:organization:write` | Edit organization information. | ✓ | | | `platform:billing:read/*` | View billing information for all products. | ✓ | ✓ | | `platform:member:read` | View the members of the organization. | ✓ | ✓ | | `platform:member_invite:write` | Invite new members to the organization. | ✓ | | | `platform:member:write` | Remove members from the organization. | ✓ | | | `platform:member_role:write/*` | Change members' roles for every product. | ✓ | | | `platform:owner_address:read` | View the organization's addresses in the address book. | ✓ | ✓ | | `platform:api_key:read` | View the organization's API keys. | ✓ | ✓ | | `platform:api_key:write` | Create and edit API keys. | ✓ | ✓ | | `platform:limits:read/platform` | View organization-level limits, such as the maximum overdraft. | ✓ | ✓ | | `platform:limits:write/platform` | Change organization-level limits that support self-serve changes. | ✓ | | Only the Owner can change limits for every product (`platform:limits:write/*`). Product Admin roles include the product-scoped version instead. For example, the CRE Admin role includes `platform:limits:write/cre`. Only limits that support self-serve changes can be changed this way. To change other limits, contact Chainlink. ### CRE CRE roles control access to workflows, secrets, limits, and workflow owner addresses. | Role | Description | | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Full CRE access, including managing secrets, changing CRE limits and roles, and linking workflow owner addresses, which is required to deploy workflows to the onchain registry. | | Developer | Deploy, pause, and delete workflows in the private registry, and manage secrets. Cannot link workflow owner addresses, so cannot deploy to the onchain registry. | | Viewer | View-only access to CRE, for monitoring workflows in the UI. | | Permission | Description | Admin | Developer | Viewer | | ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | ----- | --------- | ------ | | `cre:workflow:read` | View workflows. | ✓ | ✓ | ✓ | | `cre:workflow:artifact:read` | Download workflow artifacts. | ✓ | ✓ | ✓ | | `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | ✓ | ✓ | | | `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | ✓ | ✓ | | | `cre:secret:read` | List secrets. | ✓ | ✓ | ✓ | | `cre:secret:write` | Create, update, and delete secrets. | ✓ | ✓ | | | `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | ✓ | | | | `platform:limits:read/cre` | View CRE limits, such as the maximum spend per workflow execution. | ✓ | ✓ | ✓ | | `platform:limits:write/cre` | Change CRE limits that support self-serve changes, such as the maximum spend per workflow execution. | ✓ | | | | `platform:member_role:write/cre` | Change members' CRE roles. | ✓ | | | ### ACE ACE roles control access to policy engines, policies, targets, identities, evaluations, and active monitoring. | Role | Description | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Full ACE access, including archiving policy engines and registries, granting cross-org access, and changing members' ACE roles. | | Operator | Create and manage policies, targets, identities, evaluations, and active monitoring. Cannot archive policy engines, registries, extractors, or policy types, create wallets, or grant cross-org access. | | Viewer | View-only access to ACE. | **Policy manager** | Permission | Description | Admin | Operator | Viewer | | ------------------------------------------------- | --------------------------------------------------------------------------------------- | ----- | -------- | ------ | | `ace:policy_manager:policy_engine:read` | Read policy engines. | ✓ | ✓ | ✓ | | `ace:policy_manager:policy_engine:write` | Create and update policy engine. | ✓ | ✓ | | | `ace:policy_manager:policy_engine:archive:write` | Archive policy engine (affects everything deployed under it). | ✓ | | | | `ace:policy_manager:policy:read` | Read policies and data validator instances. | ✓ | ✓ | ✓ | | `ace:policy_manager:policy:write` | Create and update policy and data validator instances. | ✓ | ✓ | | | `ace:policy_manager:policy:archive:write` | Archive policy and data validator instances. | ✓ | ✓ | | | `ace:policy_manager:target:read` | Read targets and their protections. | ✓ | ✓ | ✓ | | `ace:policy_manager:target:write` | Create and update target and its protections. | ✓ | ✓ | | | `ace:policy_manager:target:archive:write` | Archive target and its protections. | ✓ | ✓ | | | `ace:policy_manager:target_access:read` | Read a target's cross-org evaluation access grants. | ✓ | | | | `ace:policy_manager:target_access:write` | Grant and revoke cross-org evaluation access to a target. | ✓ | | | | `ace:policy_manager:implementation:read` | Read extractors and policy types. | ✓ | ✓ | ✓ | | `ace:policy_manager:implementation:write` | Create and update extractor or policy type (updates affect every instance built on it). | ✓ | ✓ | | | `ace:policy_manager:implementation:archive:write` | Archive extractor or policy type (affects every instance built on it). | ✓ | | | **Identity manager** | Permission | Description | Admin | Operator | Viewer | | --------------------------------------------- | ------------------------------------------------------------------------------- | ----- | -------- | ------ | | `ace:identity_manager:registry:read` | Read identity and credential registries, and credential types. | ✓ | ✓ | ✓ | | `ace:identity_manager:registry:write` | Create and update identity or credential registry, and credential types. | ✓ | ✓ | | | `ace:identity_manager:registry:archive:write` | Archive identity or credential registry (affects everything deployed under it). | ✓ | | | | `ace:identity_manager:registry_access:read` | Read a registry's cross-org access grants. | ✓ | | | | `ace:identity_manager:registry_access:write` | Grant and revoke cross-org read access to a registry. | ✓ | | | | `ace:identity_manager:identity:read` | Read identities and credentials. | ✓ | ✓ | ✓ | | `ace:identity_manager:identity:write` | Create and update identity, and assign credentials. | ✓ | ✓ | | | `ace:identity_manager:identity:archive:write` | Archive identity and credentials. | ✓ | ✓ | | **Reporting** | Permission | Description | Admin | Operator | Viewer | | -------------------------------- | ------------------------------------------------- | ----- | -------- | ------ | | `ace:reporting:policy:read` | Read the reporting service's policy view. | ✓ | ✓ | ✓ | | `ace:reporting:identity:read` | Read the reporting service's identity view. | ✓ | ✓ | ✓ | | `ace:reporting:target:read` | Read the reporting service's target view. | ✓ | ✓ | ✓ | | `ace:reporting:transaction:read` | Read the reporting service's transaction view. | ✓ | ✓ | ✓ | | `ace:reporting:permit:read` | Read the reporting service's permit view. | ✓ | ✓ | ✓ | | `ace:reporting:registry:read` | Read the reporting service's registry usage view. | ✓ | ✓ | ✓ | **Evaluation** | Permission | Description | Admin | Operator | Viewer | | ----------------------------- | ------------------------- | ----- | -------- | ------ | | `ace:evaluation:permit:read` | Read evaluation permits. | ✓ | ✓ | ✓ | | `ace:evaluation:permit:write` | Create evaluation permit. | ✓ | ✓ | | **Core** | Permission | Description | Admin | Operator | Viewer | | -------------------------- | -------------------------- | ----- | -------- | ------ | | `ace:core:org_config:read` | Read organization details. | ✓ | ✓ | ✓ | | `ace:core:network:read` | Read supported networks. | ✓ | ✓ | ✓ | | `ace:core:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | | `ace:core:wallet:write` | Create wallet. | ✓ | | | **Active monitoring** | Permission | Description | Admin | Operator | Viewer | | ------------------------------------------------ | --------------------------------------------------- | ----- | -------- | ------ | | `ace:active_monitoring:action_variable:read` | Read action variables. | ✓ | ✓ | ✓ | | `ace:active_monitoring:contract_group:read` | Read contract groups. | ✓ | ✓ | ✓ | | `ace:active_monitoring:contract_group:write` | Create contract groups. | ✓ | ✓ | | | `ace:active_monitoring:rule_group:read` | Read rule groups. | ✓ | ✓ | ✓ | | `ace:active_monitoring:rule_group:write` | Create and update rule groups. | ✓ | ✓ | | | `ace:active_monitoring:monitored_address:read` | Read monitored addresses. | ✓ | ✓ | ✓ | | `ace:active_monitoring:monitored_address:write` | Add addresses to the screening watch list. | ✓ | ✓ | | | `ace:active_monitoring:screening_interval:read` | Read the screening interval. | ✓ | ✓ | ✓ | | `ace:active_monitoring:screening_interval:write` | Set, remove, start and stop the screening interval. | ✓ | ✓ | | | `ace:active_monitoring:decision_log:read` | Read decision logs. | ✓ | ✓ | ✓ | | `ace:active_monitoring:decision_log:write` | Dismiss and enforce decision logs. | ✓ | ✓ | | | `ace:active_monitoring:provider_api_key:read` | Read screening-provider API key metadata. | ✓ | ✓ | ✓ | | `ace:active_monitoring:provider_api_key:write` | Set and remove screening-provider API keys. | ✓ | ✓ | | **Administration** | Permission | Description | Admin | Operator | Viewer | | -------------------------------- | -------------------------- | ----- | -------- | ------ | | `platform:member_role:write/ace` | Change members' ACE roles. | ✓ | | | ### CRE Connect CRE Connect roles control access to operations, wallets, channels, watchers, queries, and events. | Role | Description | | -------- | ---------------------------------------------------------------------------------------------------------------------- | | Admin | Full CRE Connect access, including archiving wallets, channels, and watchers, and changing members' CRE Connect roles. | | Operator | Create and manage operations, wallets, channels, watchers, and queries. Cannot archive resources. | | Viewer | View-only access to CRE Connect. | **Core** | Permission | Description | Admin | Operator | Viewer | | --------------------------- | ----------------------------------- | ----- | -------- | ------ | | `crec:network:read` | Read available blockchain networks. | ✓ | ✓ | ✓ | | `crec:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | | `crec:wallet:write` | Create or update wallet. | ✓ | ✓ | | | `crec:wallet:archive:write` | Archive wallet. | ✓ | | | **Operations** | Permission | Description | Admin | Operator | Viewer | | -------------------------------- | --------------------------------------------------------- | ----- | -------- | ------ | | `crec:operation:read` | Read operations and search by initiator/signer/canceller. | ✓ | ✓ | ✓ | | `crec:operation:write` | Create operation (draft or pre-signed). | ✓ | ✓ | | | `crec:operation:signature:write` | Sign (finalize) or cancel operation. | ✓ | ✓ | | **Channels** | Permission | Description | Admin | Operator | Viewer | | ---------------------------- | ------------------------- | ----- | -------- | ------ | | `crec:channel:read` | Read channels. | ✓ | ✓ | ✓ | | `crec:channel:write` | Create or update channel. | ✓ | ✓ | | | `crec:channel:archive:write` | Archive channel. | ✓ | | | **Watchers** | Permission | Description | Admin | Operator | Viewer | | ---------------------------- | ------------------------- | ----- | -------- | ------ | | `crec:watcher:read` | Read watchers. | ✓ | ✓ | ✓ | | `crec:watcher:write` | Create or update watcher. | ✓ | ✓ | | | `crec:watcher:archive:write` | Archive watcher. | ✓ | | | **Queries** | Permission | Description | Admin | Operator | Viewer | | ------------------ | ------------- | ----- | -------- | ------ | | `crec:query:read` | Read queries. | ✓ | ✓ | ✓ | | `crec:query:write` | Create query. | ✓ | ✓ | | **Events** | Permission | Description | Admin | Operator | Viewer | | ----------------- | -------------------------------------------- | ----- | -------- | ------ | | `crec:event:read` | Read events, run history, and search events. | ✓ | ✓ | ✓ | **Administration** | Permission | Description | Admin | Operator | Viewer | | --------------------------------- | ---------------------------------- | ----- | -------- | ------ | | `platform:member_role:write/crec` | Change members' CRE Connect roles. | ✓ | | | ### Data Streams Data Streams has a single role. | Role | Description | | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin | Access to your organization's Data Streams subscription, and the ability to assign other members as Data Streams Admins. Each member gets their own API credentials while sharing access to the organization's Data Streams. | | Permission | Description | Admin | | ---------------------------------------- | ----------------------------------- | ----- | | `platform:member_role:write/datastreams` | Change members' Data Streams roles. | ✓ | > **NOTE: Product availability** > > Roles are available only for products your organization has access to. If a product is not enabled for your organization, members cannot be assigned a role for that product. ## Managing member roles Members with the appropriate permissions can assign and change roles for other members: - Platform Admins can manage member roles for all products. - Product Admins (for example, CRE Admins) can manage member roles for their product. - The Owner can manage member roles for all products. To assign or change a member's roles, see [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles). ## What's next? - [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles) - Change the roles that organization members hold for each product. - [API Keys](/chainlink-platform/api-keys) - Create API keys with scoped permissions for each product. - [Inviting Team Members](/chainlink-platform/inviting-team-members) - Add members to your organization. - [Understanding Organizations](/chainlink-platform/understanding-organizations) - Learn how organizations work on the Chainlink Platform.