Role-Based Access Control

Role-Based Access Control (RBAC)

SkySaver uses Role-Based Access Control to manage what users can do within the platform. This section covers the available permissions and how to configure them.

Permission Model

SkySaver uses a scope-based permission system where:

  • Scopes are individual permissions for specific actions
  • Roles are collections of commonly-used scopes
  • Users can have custom scope combinations
  • Permissions are project-specific

Quick Roles

For convenience, SkySaver provides quick role assignments:

RoleDescriptionUse Case
AdminFull access to all featuresProject administrators
MemberStandard access with modificationsTeam members
ViewerRead-only accessStakeholders, auditors

Assigning Admin Role

  1. Edit the user
  2. Open the Scopes dropdown
  3. Select Give Admin Permissions
  4. Save

Available Scopes

Account Permissions

ScopeDescription
read:accountsView accounts and their details
write:accountsAdd new accounts to the project
manage:accountModify account attributes
delete:accountsRemove accounts from the project

Member Permissions

ScopeDescription
read:project_membersView project members
write:project_membersAdd new members
manage:project_membersModify member attributes
delete:project_membersRemove members

Project Permissions

ScopeDescription
read:projectView project details
manage:projectModify project settings

Schedule Permissions

ScopeDescription
read:schedulesView schedules
write:schedulesCreate new schedules
manage:schedulesModify existing schedules

Automation Permissions

ScopeDescription
manage:automationsEnable, disable, and configure automations

Opportunities Permissions

ScopeDescription
read:opportunitiesView cost optimization opportunities

Organization Permissions

ScopeDescription
read:organizationsView AWS organization details
org:poweruserAdvanced organization management capabilities

Self Permissions

ScopeDescription
read:selfView own user profile and settings

Scope Categories

Understanding scope naming:

PrefixMeaning
read:View/list resources
write:Create new resources
manage:Modify existing resources
delete:Remove resources
org:Organization-level capabilities

Assigning Permissions

Step 1: Edit User

  1. Navigate to Users > View Members
  2. Find the user
  3. Click Edit

Step 2: Select Scopes

  1. Open the Scopes dropdown
  2. Select desired permissions
  3. Deselect any to remove

Update User Update User

Step 3: Save

Click Save to apply changes.

Common Permission Sets

Read-Only User (Viewer)

For users who only need to view data:

read:accounts
read:project_members
read:project
read:schedules

Schedule Manager

For users who manage schedules but not accounts:

read:accounts
read:project
read:schedules
write:schedules
manage:schedules

Account Manager

For users who manage AWS accounts:

read:accounts
write:accounts
manage:account
read:project

Full Access (Admin)

All scopes, or use the Give Admin Permissions shortcut.

New User Defaults

New users start with no permissions:

  1. User is added to project
  2. User has blank access
  3. Admin must assign scopes
  4. User can then access features

Important: Always assign permissions after adding users.

Auditing Permissions

Regularly review user permissions:

  1. Navigate to Users > View Members
  2. Review each user’s scopes
  3. Verify access is still appropriate
  4. Remove unused permissions

Security Best Practices

  1. Least privilege - Grant only what’s needed
  2. Regular audits - Review permissions quarterly
  3. Prompt removal - Remove access when users leave
  4. Limit admins - Keep admin count minimal
  5. Document - Record why users have specific access

Troubleshooting

IssueCauseSolution
Can’t view accountsMissing read:accountsAdd the scope
Can’t create schedulesMissing write:schedulesAdd the scope
Can’t edit settingsMissing manage: scopeAdd appropriate manage scope
Access deniedMultiple missing scopesReview required scopes