# Permissions Required for Various RudderStack Features


This guide provides a comprehensive reference of the permissions required to use different RudderStack features in the new Access Management system.

It also lists the permissions required to use the same features in the [legacy Permissions Management (RBAC) system]({{< ref "archive/dashboard-guides/user-management.md" >}}) for comparison.

## APIs

{{< info >}}
To consume APIs, you require a [Service Access Token]({{< ref "access-management/service-access-tokens.md" >}}) with specific permissions.
{{< /info >}}

### Audit Logs API

- **Access Management system**: Organization-level Service Access Token
- **Legacy RBAC system**: Organization-level Service Access Token

See [Audit Logs API]({{< ref "api/audit-logs-api.md#prerequisites" >}}) for more details.

### Data Catalog API

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Tracking Plans | **Create & Delete**, **Edit** |
| Data Catalog | **Edit** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [Data Catalog API]({{< ref "api/data-catalog-api/tracking-plans.md" >}}) for more details.

### Event Audit API

- **Access Management system**: Workspace-level Service Access Token with **no** dedicated permissions
- **Legacy RBAC system**: Workspace-level Service Access Token with **Viewer** permissions

See [Event Audit API]({{< ref "api/event-audit-api/" >}}) for more details.

### HTTP API

No dedicated permissions are required to consume the HTTP API — it uses your [source write key]({{< ref "api/http-api.md#prerequisites" >}}) for authentication.

### Pixel API

No dedicated permissions are required to consume the Pixel API — it uses your [source write key]({{< ref "api/pixel-api.md#prerequisites" >}}) for authentication.

### Profiles API

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Profiles | **Edit** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Editor** permissions

See [Profiles API]({{< ref "api/profiles-api.md#prerequisites" >}}) for more details.

### Reverse ETL Connections API

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Tables / SQL Models / Audiences | **Edit**, **Connect** |
| Destinations | **Edit**, **Connect** |
| PII permissions  <br/> <span style="color: #4D4DFF;font-size:12px;">Enterprise plan only</span> | **Reverse ETL Sync Failure Samples** configured for the required source | 

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [Reverse ETL Connections API]({{< ref "api/retl-connections-api.md#prerequisites" >}}) for more details.

### Test API

- **Access Management system**: Workspace-level Service Access Token with **no** dedicated permissions
- **Legacy RBAC system**: Workspace-level Service Access Token with **Viewer** permissions

See [Test API]({{< ref "api/test-api.md#prerequisites" >}}) for more details.

### Transformations API

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Transformations | **Create & Delete**, **Connect**, **Edit** |
| Transformation Libraries | **Edit** |
| Destinations | **Connect** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions with **Grant edit access** toggled on under **Transformations**.

{{< image src="images/access-management/permissions/legacy/admin-transformations.webp" alt="workspace-level Service Access Token with Transformations Admin permission" >}}

See [Transformations API]({{< ref "api/transformation-api.md#prerequisites" >}}) for more details.

### User Suppression API

- **Access Management system**: Workspace-level Service Access Token with **no** dedicated permissions
- **Legacy RBAC system**: Workspace-level Service Access Token with **Viewer** permissions

See [User Suppression API]({{< ref "api/user-suppression-api/_index.md#prerequisites" >}}) for more details.

## AI Features

{{< info >}}
To use these features, you require a [Service Access Token]({{< ref "access-management/service-access-tokens.md" >}}) with specific permissions.
{{< /info >}}

### Rudder AI Reviewer

- **Access Management system**: Workspace-level Service Access Token with **no** dedicated permissions
- **Legacy RBAC system**: Workspace-level Service Access Token with **Viewer** permissions

See [Rudder AI Reviewer]({{< ref "ai-features/rudder-ai-reviewer/get-started.md#prerequisites" >}}) for more details.

## CLI and Dev Tools

{{< info >}}
To use these tools, you require a [Service Access Token]({{< ref "access-management/service-access-tokens.md" >}}) with specific permissions.
{{< /info >}}

### RudderTyper

- **Access Management system**: Workspace-level Service Access Token with **no** dedicated permissions
- **Legacy RBAC system**: Workspace-level Service Access Token with **Viewer** permissions

See [RudderTyper]({{< ref "dev-tools/ruddertyper.md#prerequisites" >}}) for more details.

### Rudder CLI

{{< info >}}
To use Rudder CLI, you require a [Service Access Token]({{< ref "access-management/service-access-tokens.md" >}}) with specific permissions to manage the resources you want to manage.
{{< /info >}}

#### Tracking Plans and Data Catalog

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Tracking Plans | **Create & Delete**, **Edit** |
| Data Catalog | **Edit** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [CLI-based Tracking Plans and Data Catalog Management]({{< ref "dev-tools/rudder-cli/data-catalog-and-tracking-plans/" >}}) for more details.

#### Event Stream Sources

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions | <div style="width:350px">Description</div> | 
| :----| :-----| :----|
| Event Stream Sources | **Create & Delete** | Create or delete Event Stream sources in the workspace | 
| Event Stream Sources | **Edit** | Make changes to the configuration of Event Stream sources | 
| Event Stream Sources | **Connect** | Connect an Event Stream source to a Tracking Plan | 
| Tracking Plans | **Edit**, **Connect** | Connect a Tracking Plan to an Event Stream source | 

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [Manage Event Stream Sources using Rudder CLI]({{< ref "dev-tools/rudder-cli/event-stream-sources.md" >}}) for more details.

#### SQL Models

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| SQL Models | **Create & Delete**, **Edit** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [Manage SQL Models using Rudder CLI]({{< ref "dev-tools/rudder-cli/sql-models/" >}}) for more details.

#### Transformations and Transformation Libraries

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Transformations | **Create & Delete**, **Edit**, **Connect** |
| Transformation Libraries | **Edit** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** role and **Grant edit access** toggled on under **Transformations**

See [Manage Transformations and Transformation Libraries using Rudder CLI]({{< ref "dev-tools/rudder-cli/manage-transformations.md" >}}) for more details.

## Data Governance

This section lists the permissions required to use different Data Governance features in the new Access Management system.

### Tracking Plans

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage tracking plans
    - Members must have the following permissions:

| Resource | Permissions |
| :----| :-----|
| Tracking Plans | **Create & Delete**, **Edit**, **Connect** |
| Data Catalog | **Edit** |

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to create and manage Tracking Plans
    - Members with the **Connections Admin** role in their workspace policy can create and manage Tracking Plans
    - Members with the **Connections Editor** role in their workspace policy can only connect Tracking Plans to Event Stream sources

See the [Tracking Plans documentation]({{< ref "data-governance/tracking-plans/create-tracking-plans.md#required-permissions" >}}) for more details.

### Data Catalog

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to manage Data Catalog
    - Members must have the following permissions:

| Resource | Permissions |
| :----| :-----|
| Data Catalog | **Edit** |

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to manage Data Catalog
    - Members must have the **Connections Admin** role in their workspace policy

See the [Data Catalog documentation]({{< ref "data-governance/data-catalog/properties.md#required-permissions" >}}) for more details.

### Bot Management

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to the Bot Management feature
    - Members must have the **Bot Management** permission

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to the Bot Management feature
    - Members must have the **Connections Admin** role in their workspace policy

See the [Bot Management documentation]({{< ref "data-governance/bot-management.md#required-permissions" >}}) for more details.

### Event Blocking

- **Access Management system**: Only [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) can manage event blocking
- **Legacy RBAC system**: Only [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) can manage event blocking

See [Event Blocking]({{< ref "data-governance/event-blocking.md#enable-event-blocking" >}}) for more details.

### Alerts

- **Access Management system**: 

    - Only [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) can set up workspace-level alerts
    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) and Members with the **Alert Overrides** permission can set up resource-level alerts

- **Legacy RBAC system**:

    - Only [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) can set up workspace-level alerts
    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) and members with the **Connections Admin** role in their workspace policy can set up resource-level alerts

See [Configurable Alerts]({{< ref "monitor/alerts.md#required-permissions" >}}) for more details.

## Data Pipelines

This section lists the permissions required to manage data pipelines and their associated resources.

### Event Stream Sources

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage event stream sources
    - Members can have the following permissions in their workspace policy:

| Resource | Permissions |
| :----| :-----|
| Event Stream Sources | **Edit**, **Connect**, **Create & Delete** |

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to create and manage Event Stream sources
    - Members with the **Connections Admin** role in their workspace policy can create and manage Event Stream sources
    - Members with the **Connections Editor** role in their workspace policy can only edit the Event Stream source configuration and connect Event Stream sources to destinations

See [Event Stream Sources]({{< ref "sources/event-streams/_index.md#required-permissions" >}}) for more details.

### Reverse ETL Sources

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage reverse ETL sources
    - Members can have the following permissions in their workspace policy:

| Resource | Permissions |
| :----| :-----|
| Tables / SQL Models / Audiences | **Edit**, **Connect**, **Create & Delete** |

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to create and manage reverse ETL sources
    - Members with the **Connections Admin** role in their workspace policy can create and manage reverse ETL sources
    - Members with the **Connections Editor** role in their workspace policy can only edit the reverse ETL source configuration and connect reverse ETL sources to destinations

See [Reverse ETL Sources]({{< ref "sources/reverse-etl/_index.md#required-permissions" >}}) for more details.

### Destinations

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage destinations
    - Members can have the following permissions in their workspace policy:

| Resource | Permissions |
| :----| :-----|
| Destinations | **Edit**, **Connect**, **Create & Delete** |

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to create and manage destinations
    - Members with the **Connections Admin** role in their workspace policy can create and manage destinations
    - Members with the **Connections Editor** role in their workspace policy can only edit the destination configuration and connect destinations to sources

See [Destinations]({{< ref "destinations/overview.md#required-permissions" >}}) for more details.

### Airflow Orchestrator

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Tables / SQL Models / Audiences | **Edit**, **Connect** |
| Destinations | **Edit**, **Connect** |
| Profiles | **Edit**, **Connect** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [RudderStack Airflow Integration]({{< ref "orchestration/airflow.md#prerequisites" >}}) for more details.

### Dagster Orchestrator

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Tables / SQL Models / Audiences | **Edit**, **Connect** |
| Destinations | **Edit**, **Connect** |
| Profiles | **Edit**, **Connect** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [RudderStack Dagster Integration]({{< ref "orchestration/dagster.md#prerequisites" >}}) for more details.

## Profiles

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage Profiles projects
    - Members can have the following permissions in their workspace policy:

| Resource | Permissions |
| :----| :-----|
| Profiles | **Edit**, **Create & Delete**, **Connect** |

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to create and manage Profiles projects
    - Members with the **Connections Admin** role in their workspace policy can create and manage Profiles projects
    - Members with the **Connections Editor** role in their workspace policy can only edit the Profiles project configuration and connect Profiles projects to destinations

See [Profiles Quickstart]({{< ref "profiles/overview/quickstart.md#required-permissions" >}}) for more details.

### Activation API

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| PII Permission | **Destination Data Access** for the specific Redis destination |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** permissions

See [Activation API]({{< ref "profiles/dev-docs/activation-api/_index.md#prerequisites" >}}) for more details.

### Profiles Audit

- **Access Management system**: Workspace-level Service Access Token with **no** dedicated permissions
- **Legacy RBAC system**: Workspace-level Service Access Token with **Viewer** permissions

See the [Profiles Audit documentation]({{< ref "profiles/dev-docs/profiles-audit.md#prerequisites" >}}) for more details.

## SSO and Audit Logs

This section lists the permissions required to use the Audit Logs and different SSO setups.

### Audit Logs

- **Access Management system**: Only [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) can access the Audit Logs
- **Legacy RBAC system**: Only [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) can access the Audit Logs

See [Audit Logs]({{< ref "dashboard-guides/audit-logs.md" >}}) for more details.

### Okta SSO (SCIM)

- **Access Management system**: Organization-level Service Access Token
- **Legacy RBAC system**: Organization-level Service Access Token

See [Okta SCIM Configuration]({{< ref "user-guides/sso-setup/okta/scim-configuration.md#prerequisites" >}}) for more details.

### Azure Entra ID SSO (SCIM)

- **Access Management system**: Organization-level Service Access Token
- **Legacy RBAC system**: Organization-level Service Access Token

See [Azure Entra ID SSO Setup]({{< ref "user-guides/sso-setup/azure/_index.md#prerequisites" >}}) for more details.

## Transformations

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage transformations
    - Members can have the following permissions in their workspace policy:

| Resource | Permissions |
| :----| :-----|
| Transformations | **Edit**, **Connect**, **Create & Delete** |

- **Legacy RBAC system**:

    - Org Admins have full access
    - Members must have the **Grant edit access** permission in **Transformations and Library** toggled on to create, edit, and delete transformations
    - Members with the **Connections Admin** or **Connections Editor** role in their workspace policy can only connect transformations to destinations

See [Transformations]({{< ref "transformations/create.md#required-permissions" >}}) for more details.

### Libraries

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to create and manage transformation libraries
    - Members must have the **Transformation Libraries** permission in their workspace policy

- **Legacy RBAC system**:

    - Org Admins have full access
    - Members must have the **Grant edit access** permission in **Transformations and Library** toggled on to create, edit, and delete transformation libraries

See [Transformation Libraries]({{< ref "transformations/libraries.md#required-permissions" >}}) for more details.

### Credential Store

- **Access Management system**:

    - [Admins]({{< ref "access-management/member-management.md#member-roles" >}}) have full access to the credential store
    - Members must have the **Credential Store** permission in their workspace policy

- **Legacy RBAC system**:

    - [Org Admins]({{< ref "archive/dashboard-guides/user-management.md#organization-roles" >}}) have full access to the credential store
    - Members must have the **Connections Admin** role in their workspace policy

See [Credential Store]({{< ref "transformations/credentials.md#required-permissions" >}}) for more details.

### Transformation Action

- **Access Management system**: Workspace-level Service Access Token with the following permissions:

| Resource | Permissions |
| :----| :-----|
| Transformations | **Edit**, **Connect**, **Create & Delete** |
| Transformation Libraries | **Edit** |

- **Legacy RBAC system**: Workspace-level Service Access Token with **Admin** role and **Grant edit access** toggled on under **Transformations**

See [Transformation Action]({{< ref "transformations/transformation-action/_index.md#prerequisites" >}}) for more details.

<br />