Roles and permissions

RBAC collections, CRUD flags, Admin vs custom roles, and how limits apply to Applications and Worker Nodes.

Written By Zoro

Last updated 9 days ago

dFlow enforces organisation-scoped RBAC: each member has one role per Organisation, and that role grants Create, Read, Update, and Delete on a fixed set of collections. Server actions check those flags (for example servers.update, team.read) before running.

Use Workspace → Team → Role Management to view or edit roles.

Collections (permission rows)

cloudProviderAccountsLinked cloud provider accounts (for example Azure OAuth connections and AWS keys used for compute).
securityGroupsSecurity → Security groups.
serversWorker Nodes and server lifecycle (add server, Dokku prep, monitoring tools, and similar).
gitProvidersGit provider connections (GitHub App, tokens, and similar).
dockerRegistriesDocker registry integrations.
teamTeam Members: listing members, inviting, changing roles, removing members.

If a user lacks Read on a collection, related pages and actions typically disappear or return access errors.

How team permissions map to tasks

Connect Azure or AWS under IntegrationscloudProviderAccounts.create and cloudProviderAccounts.read
Provision a cloud Worker Nodeservers.create and cloudProviderAccounts.read
Manage Security groups for AWSsecurityGroups and usually cloudProviderAccounts.read