RubyGems - openc3-cosmos-tool-docs - Versions diffs - 6.9.0 → 6.9.2 - Mend

openc3-cosmos-tool-docs 6.9.0 → 6.9.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (327) hide show

data/tools/staticdocs/docs/guides/roles-permissions.html ADDED Viewed

@@ -0,0 +1,191 @@
+<!doctype html><html lang=en dir=ltr class="docs-wrapper plugin-docs plugin-id-default docs-version-current docs-doc-page docs-doc-id-guides/roles-permissions" data-has-hydrated=false><head><meta charset=UTF-8><meta name=generator content="Docusaurus v3.9.2"><title data-rh=true>Roles and Permissions | OpenC3 Docs</title><meta data-rh=true name=viewport content="width=device-width, initial-scale=1.0"/><meta data-rh=true name=twitter:card content=summary_large_image /><meta data-rh=true property=og:url content=https://docs.openc3.com/tools/staticdocs/docs/guides/roles-permissions /><meta data-rh=true property=og:locale content=en /><meta data-rh=true name=docusaurus_locale content=en /><meta data-rh=true name=docsearch:language content=en /><meta data-rh=true name=docusaurus_version content=current /><meta data-rh=true name=docusaurus_tag content=docs-default-current /><meta data-rh=true name=docsearch:version content=current /><meta data-rh=true name=docsearch:docusaurus_tag content=docs-default-current /><meta data-rh=true property=og:title content="Roles and Permissions | OpenC3 Docs"/><meta data-rh=true name=description content="Understanding COSMOS Enterprise roles and access control"/><meta data-rh=true property=og:description content="Understanding COSMOS Enterprise roles and access control"/><link data-rh=true rel=icon href=/tools/staticdocs/img/favicon.png /><link data-rh=true rel=canonical href=https://docs.openc3.com/tools/staticdocs/docs/guides/roles-permissions /><link data-rh=true rel=alternate href=https://docs.openc3.com/tools/staticdocs/docs/guides/roles-permissions hreflang=en /><link data-rh=true rel=alternate href=https://docs.openc3.com/tools/staticdocs/docs/guides/roles-permissions hreflang=x-default /><script data-rh=true type=application/ld+json>{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","item":"https://docs.openc3.com/tools/staticdocs/docs/guides","name":"Guides","position":1},{"@type":"ListItem","item":"https://docs.openc3.com/tools/staticdocs/docs/guides/roles-permissions","name":"Roles and Permissions","position":2}]}</script><link rel=stylesheet href=/tools/staticdocs/assets/css/styles.41902cce.css /><script src=/tools/staticdocs/assets/js/runtime~main.44a60fd4.js defer></script><script src=/tools/staticdocs/assets/js/main.1ae7ceb9.js defer></script></head><body class=navigation-with-keyboard><svg style="display: none;"><defs>
+<symbol id=theme-svg-external-link viewBox="0 0 24 24"><path fill=currentColor d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"/></symbol>
+</defs></svg>
+<script>!function(){var t;document.documentElement.setAttribute("data-theme",t||"dark"),document.documentElement.setAttribute("data-theme-choice",t||"dark")}(),function(){try{for(var[t,e]of new URLSearchParams(window.location.search).entries())if(t.startsWith("docusaurus-data-")){var a=t.replace("docusaurus-data-","data-");document.documentElement.setAttribute(a,e)}}catch(t){}}()</script><div id=__docusaurus><link rel=preload as=image href=/tools/staticdocs/img/logo.svg /><div role=region aria-label="Skip to main content"><a class=skipToContent_Ad3x href=#__docusaurus_skipToContent_fallback>Skip to main content</a></div><nav aria-label=Main class="theme-layout-navbar navbar navbar--fixed-top"><div class=navbar__inner><div class="theme-layout-navbar-left navbar__items"><button aria-label="Toggle navigation bar" aria-expanded=false class="navbar__toggle clean-btn" type=button><svg width=30 height=30 viewBox="0 0 30 30" aria-hidden=true><path stroke=currentColor stroke-linecap=round stroke-miterlimit=10 stroke-width=2 d="M4 7h22M4 15h22M4 23h22"/></svg></button><a class=navbar__brand href=/tools/staticdocs/><div class=navbar__logo><img src=/tools/staticdocs/img/logo.svg alt="OpenC3 Logo" class="themedComponent_iYMB themedComponent--light__u60"/><img src=/tools/staticdocs/img/logo.svg alt="OpenC3 Logo" class="themedComponent_iYMB themedComponent--dark_bnZ2"/></div><b class="navbar__title text--truncate">OpenC3 Docs</b></a><a aria-current=page class="navbar__item navbar__link navbar__link--active" href=/tools/staticdocs/docs>Documentation</a><a href=https://openc3.com/enterprise/ target=_blank rel="noopener noreferrer" class="navbar__item navbar__link">Enterprise</a></div><div class="theme-layout-navbar-right navbar__items navbar__items--right"><div class=navbarSearchContainer_BlpL><div class=navbar__search><span aria-label="expand searchbar" role=button class=search-icon tabindex=0></span><input id=search_input_react type=search placeholder=Loading... aria-label=Search class="navbar__search-input search-bar" disabled/></div></div></div></div><div role=presentation class=navbar-sidebar__backdrop></div></nav><div id=__docusaurus_skipToContent_fallback class="theme-layout-main main-wrapper mainWrapper_LBOZ"><div class=docsWrapper_fTY1><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_yH7o" type=button></button><div class=docRoot_stlz><aside class="theme-doc-sidebar-container docSidebarContainer_GDN6"><div class=sidebarViewport_N1UE><div class=sidebar_dl38><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu___bF"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class=menu__link href=/tools/staticdocs/docs><span title=Introduction class=linkLabel_XLMJ>Introduction</span></a><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_u_d3 menu__link menu__link--sublist" href=/tools/staticdocs/docs/getting-started><span title="Getting Started" class=categoryLinkLabel_RXyj>Getting Started</span></a><button aria-label="Expand sidebar category 'Getting Started'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_u_d3 menu__link menu__link--sublist" href=/tools/staticdocs/docs/configuration><span title=Configuration class=categoryLinkLabel_RXyj>Configuration</span></a><button aria-label="Expand sidebar category 'Configuration'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_u_d3 menu__link menu__link--sublist" href=/tools/staticdocs/docs/tools><span title=Tools class=categoryLinkLabel_RXyj>Tools</span></a><button aria-label="Expand sidebar category 'Tools'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class=menu__list-item-collapsible><a class="categoryLink_u_d3 menu__link menu__link--sublist menu__link--active" href=/tools/staticdocs/docs/guides><span title=Guides class=categoryLinkLabel_RXyj>Guides</span></a><button aria-label="Collapse sidebar category 'Guides'" aria-expanded=true type=button class="clean-btn menu__caret"></button></div><ul class=menu__list><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/bridges><span title=Bridges class=linkLabel_XLMJ>Bridges</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/cfs><span title="COSMOS and NASA cFS" class=linkLabel_XLMJ>COSMOS and NASA cFS</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/custom-widgets><span title="Custom Widgets" class=linkLabel_XLMJ>Custom Widgets</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/dynamic-packets><span title="Dynamic Packets" class=linkLabel_XLMJ>Dynamic Packets</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/exposing-microservices><span title="Exposing Microservices" class=linkLabel_XLMJ>Exposing Microservices</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/little-endian-bitfields><span title="Little Endian Bitfields" class=linkLabel_XLMJ>Little Endian Bitfields</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/local-mode><span title="Local Mode" class=linkLabel_XLMJ>Local Mode</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/logging><span title=Logging class=linkLabel_XLMJ>Logging</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/monitoring><span title=Monitoring class=linkLabel_XLMJ>Monitoring</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/performance><span title=Performance class=linkLabel_XLMJ>Performance</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/raspberrypi><span title="Raspberry Pi" class=linkLabel_XLMJ>Raspberry Pi</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/reference-architectures><span title="Reference Architectures" class=linkLabel_XLMJ>Reference Architectures</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class="menu__link menu__link--active" aria-current=page tabindex=0 href=/tools/staticdocs/docs/guides/roles-permissions><span title="Roles and Permissions" class=linkLabel_XLMJ>Roles and Permissions</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/script-writing><span title="Script Writing Guide" class=linkLabel_XLMJ>Script Writing Guide</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/scripting-api><span title="Scripting API Guide" class=linkLabel_XLMJ>Scripting API Guide</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/tools/staticdocs/docs/guides/troubleshooting><span title=Troubleshooting class=linkLabel_XLMJ>Troubleshooting</span></a></ul><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_u_d3 menu__link menu__link--sublist" href=/tools/staticdocs/docs/development><span title=Development class=categoryLinkLabel_RXyj>Development</span></a><button aria-label="Expand sidebar category 'Development'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_u_d3 menu__link menu__link--sublist" href=/tools/staticdocs/docs/meta><span title=Meta class=categoryLinkLabel_RXyj>Meta</span></a><button aria-label="Expand sidebar category 'Meta'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class=menu__link href=/tools/staticdocs/docs/privacy><span title="OpenC3, Inc. Privacy Policy" class=linkLabel_XLMJ>OpenC3, Inc. Privacy Policy</span></a></ul></nav></div></div></aside><main class=docMainContainer_I77d><div class="container padding-top--md padding-bottom--lg"><div class=row><div class="col docItemCol_Vt7O"><div class=docItemContainer_E44C><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_j0mV" aria-label=Breadcrumbs><ul class=breadcrumbs><li class=breadcrumbs__item><a aria-label="Home page" class=breadcrumbs__link href=/tools/staticdocs/><svg viewBox="0 0 24 24" class=breadcrumbHomeIcon_bFVZ><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill=currentColor /></svg></a><li class=breadcrumbs__item><a class=breadcrumbs__link href=/tools/staticdocs/docs/guides><span>Guides</span></a><li class="breadcrumbs__item breadcrumbs__item--active"><span class=breadcrumbs__link>Roles and Permissions</span></ul></nav><div class="tocCollapsible_XYrz theme-doc-toc-mobile tocMobile_SBzZ"><button type=button class="clean-btn tocCollapsibleButton_hLJL">On this page</button></div><div class="theme-doc-markdown markdown"><header><h1>Roles and Permissions</h1></header><p>COSMOS Enterprise provides a comprehensive role-based access control (RBAC) system that allows you to manage user permissions across different scopes. This system integrates with Keycloak for authentication and authorization.</p>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=overview>Overview<a href=#overview class=hash-link aria-label="Direct link to Overview" title="Direct link to Overview" translate=no></a></h2>
+<p>Roles in COSMOS Enterprise control what actions users can perform within the system. Roles are assigned to users per scope, allowing fine-grained control over access to different missions or projects.</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=role-naming-convention>Role Naming Convention<a href=#role-naming-convention class=hash-link aria-label="Direct link to Role Naming Convention" title="Direct link to Role Naming Convention" translate=no></a></h3>
+<p>Roles are assigned using the format: <code>{SCOPE}__{ROLE_NAME}</code></p>
+<ul>
+<li class=""><code>SCOPE</code>: The scope name (e.g., <code>DEFAULT</code>) or <code>ALLSCOPES</code> for global permissions</li>
+<li class=""><code>ROLE_NAME</code>: One of the built-in roles or a custom role name</li>
+</ul>
+<p>Examples:</p>
+<ul>
+<li class=""><code>DEFAULT__operator</code> - Operator role in the DEFAULT scope</li>
+<li class=""><code>MISSION1__viewer</code> - Viewer role in the MISSION1 scope</li>
+<li class=""><code>ALLSCOPES__admin</code> - Admin role across all scopes</li>
+</ul>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=built-in-roles>Built-in Roles<a href=#built-in-roles class=hash-link aria-label="Direct link to Built-in Roles" title="Direct link to Built-in Roles" translate=no></a></h2>
+<p>Individual built-in roles in COSMOS Enterprise are scoped to a minimal set of permissions. Individual users can have multiple roles (e.g., Admin and Operator) if users need administrative access and commanding access. COSMOS Enterprise includes five built-in roles with predefined permission sets:</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=admin>Admin<a href=#admin class=hash-link aria-label="Direct link to Admin" title="Direct link to Admin" translate=no></a></h3>
+<p>The <strong>Admin</strong> role provides administrative access within a scope. Admins can also manage the files within the MinIO bucket.</p>
+<p><strong>Permissions:</strong></p>
+<ul>
+<li class=""><code>system</code> - View system information</li>
+<li class=""><code>system_set</code> - Modify system settings</li>
+<li class=""><code>tlm</code> - View telemetry data</li>
+<li class=""><code>cmd_info</code> - View command information</li>
+<li class=""><code>script_view</code> - View scripts</li>
+<li class=""><code>admin</code> - Administrative functions (manage plugins, targets, interfaces, etc.)</li>
+</ul>
+<p><strong>Special Cases:</strong></p>
+<ul>
+<li class="">When assigned to <code>ALLSCOPES</code>, gains <code>superadmin</code> permission for system-wide administration</li>
+<li class="">Can release command authority taken by other users in their scope</li>
+</ul>
+<p><strong>Use Case:</strong> Users responsible for system configuration and management.</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=operator>Operator<a href=#operator class=hash-link aria-label="Direct link to Operator" title="Direct link to Operator" translate=no></a></h3>
+<p>The <strong>Operator</strong> role has full access except for administrative functions and approval rights.</p>
+<p><strong>Permissions:</strong></p>
+<ul>
+<li class=""><code>system</code> - View system information</li>
+<li class=""><code>system_set</code> - Modify system settings</li>
+<li class=""><code>tlm</code> - View telemetry data</li>
+<li class=""><code>tlm_set</code> - Modify telemetry settings</li>
+<li class=""><code>cmd_info</code> - View command information</li>
+<li class=""><code>cmd_raw</code> - Send raw commands</li>
+<li class=""><code>cmd</code> - Send commands</li>
+<li class=""><code>script_view</code> - View scripts</li>
+<li class=""><code>script_edit</code> - Create and edit scripts</li>
+<li class=""><code>script_run</code> - Run scripts</li>
+</ul>
+<p><strong>Use Case:</strong> Power users who need full operational control but not administrative access.</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=viewer>Viewer<a href=#viewer class=hash-link aria-label="Direct link to Viewer" title="Direct link to Viewer" translate=no></a></h3>
+<p>The <strong>Viewer</strong> role provides read-only access to the system.</p>
+<p><strong>Permissions:</strong></p>
+<ul>
+<li class=""><code>system</code> - View system information</li>
+<li class=""><code>tlm</code> - View telemetry data</li>
+<li class=""><code>cmd_info</code> - View command information</li>
+<li class=""><code>script_view</code> - View scripts</li>
+</ul>
+<p><strong>Use Case:</strong> Users who need to monitor telemetry and system status without making changes.</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=approver>Approver<a href=#approver class=hash-link aria-label="Direct link to Approver" title="Direct link to Approver" translate=no></a></h3>
+<p>The <strong>Approver</strong> role is specifically for command approval workflows.</p>
+<p><strong>Permissions:</strong></p>
+<ul>
+<li class=""><code>approve_hazardous</code> - Approve hazardous commands</li>
+<li class=""><code>approve_restricted</code> - Approve restricted commands</li>
+<li class=""><code>approve_normal</code> - Approve normal commands</li>
+</ul>
+<p><strong>Use Case:</strong> Users responsible for reviewing and approving commands before execution.</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=runner>Runner<a href=#runner class=hash-link aria-label="Direct link to Runner" title="Direct link to Runner" translate=no></a></h3>
+<p>The <strong>Runner</strong> role allows users to execute commands and scripts but cannot create or edit them. Runner does not come with approval rights.</p>
+<p><strong>Permissions:</strong></p>
+<ul>
+<li class=""><code>system</code> - View system information</li>
+<li class=""><code>system_set</code> - Modify system settings</li>
+<li class=""><code>tlm</code> - View telemetry data</li>
+<li class=""><code>tlm_set</code> - Modify telemetry settings</li>
+<li class=""><code>cmd_info</code> - View command information</li>
+<li class=""><code>cmd_raw</code> - Send raw commands</li>
+<li class=""><code>cmd</code> - Send commands</li>
+<li class=""><code>script_view</code> - View scripts</li>
+<li class=""><code>script_run</code> - Run scripts</li>
+</ul>
+<p><strong>Use Case:</strong> Operators who execute procedures and send commands but don't modify configurations or scripts.</p>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=permission-definitions>Permission Definitions<a href=#permission-definitions class=hash-link aria-label="Direct link to Permission Definitions" title="Direct link to Permission Definitions" translate=no></a></h2>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=system-permissions>System Permissions<a href=#system-permissions class=hash-link aria-label="Direct link to System Permissions" title="Direct link to System Permissions" translate=no></a></h3>
+<ul>
+<li class=""><strong>system</strong> - View system information and status</li>
+<li class=""><strong>system_set</strong> - Modify system settings and configurations</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=telemetry-permissions>Telemetry Permissions<a href=#telemetry-permissions class=hash-link aria-label="Direct link to Telemetry Permissions" title="Direct link to Telemetry Permissions" translate=no></a></h3>
+<ul>
+<li class=""><strong>tlm</strong> - View telemetry data</li>
+<li class=""><strong>tlm_set</strong> - Modify telemetry settings (limits, conversions, etc.)</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=command-permissions>Command Permissions<a href=#command-permissions class=hash-link aria-label="Direct link to Command Permissions" title="Direct link to Command Permissions" translate=no></a></h3>
+<ul>
+<li class=""><strong>cmd_info</strong> - View command definitions and parameters</li>
+<li class=""><strong>cmd_raw</strong> - Send raw binary commands</li>
+<li class=""><strong>cmd</strong> - Send commands to targets</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=script-permissions>Script Permissions<a href=#script-permissions class=hash-link aria-label="Direct link to Script Permissions" title="Direct link to Script Permissions" translate=no></a></h3>
+<ul>
+<li class=""><strong>script_view</strong> - View script contents</li>
+<li class=""><strong>script_edit</strong> - Create, edit, and delete scripts</li>
+<li class=""><strong>script_run</strong> - Execute scripts</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=administrative-permissions>Administrative Permissions<a href=#administrative-permissions class=hash-link aria-label="Direct link to Administrative Permissions" title="Direct link to Administrative Permissions" translate=no></a></h3>
+<ul>
+<li class=""><strong>admin</strong> - Manage scope-level resources (targets, plugins, interfaces, routers, etc.)</li>
+<li class=""><strong>superadmin</strong> - System-wide administration across all scopes (requires <code>ALLSCOPES__admin</code>)</li>
+</ul>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=approval-permissions>Approval Permissions<a href=#approval-permissions class=hash-link aria-label="Direct link to Approval Permissions" title="Direct link to Approval Permissions" translate=no></a></h3>
+<ul>
+<li class=""><strong>approve_hazardous</strong> - Approve hazardous commands</li>
+<li class=""><strong>approve_restricted</strong> - Approve restricted commands</li>
+<li class=""><strong>approve_normal</strong> - Approve normal commands</li>
+</ul>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=command-authority>Command Authority<a href=#command-authority class=hash-link aria-label="Direct link to Command Authority" title="Direct link to Command Authority" translate=no></a></h2>
+<p>When command authority is enabled for a scope, an additional layer of authorization is applied to command-related permissions:</p>
+<ul>
+<li class="">Users must "take" command authority for a specific target before sending commands</li>
+<li class="">Only the user who holds command authority can send commands to that target</li>
+<li class="">Admin users (with <code>ALLSCOPES__admin</code> or <code>{SCOPE}__admin</code>) can release authority taken by other users</li>
+<li class="">Command authority applies to these permissions when executed manually:<!-- -->
+<ul>
+<li class=""><code>tlm_set</code></li>
+<li class=""><code>cmd_raw</code></li>
+<li class=""><code>cmd</code></li>
+<li class=""><code>script_run</code></li>
+</ul>
+</li>
+</ul>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=custom-roles>Custom Roles<a href=#custom-roles class=hash-link aria-label="Direct link to Custom Roles" title="Direct link to Custom Roles" translate=no></a></h2>
+<p>In addition to the built-in roles, you can create custom roles with specific permission combinations.</p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=creating-custom-roles>Creating Custom Roles<a href=#creating-custom-roles class=hash-link aria-label="Direct link to Creating Custom Roles" title="Direct link to Creating Custom Roles" translate=no></a></h3>
+<p>Custom roles are managed through the Admin Tool:</p>
+<ol>
+<li class="">Navigate to the Admin Tool</li>
+<li class="">Go to the Roles tab</li>
+<li class="">Click "Add" and enter a role name (single lowercase word recommended)</li>
+<li class="">Click "Edit" to configure permissions for the role</li>
+</ol>
+<p><img decoding=async loading=lazy alt="Add Role" src=/tools/staticdocs/assets/images/add_role-e99225cd280a9de1e354586f00c92f52d0dae856ac015a561da2dd405de6cb55.png width=2566 height=860 class=img_JrJa /></p>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=custom-role-permissions>Custom Role Permissions<a href=#custom-role-permissions class=hash-link aria-label="Direct link to Custom Role Permissions" title="Direct link to Custom Role Permissions" translate=no></a></h3>
+<p>Custom roles can have granular permissions that target specific resources:</p>
+<ul>
+<li class=""><strong>target_name</strong> - Restrict permission to a specific target</li>
+<li class=""><strong>packet_name</strong> - Restrict permission to a specific packet</li>
+<li class=""><strong>interface_name</strong> - Restrict permission to a specific interface</li>
+<li class=""><strong>router_name</strong> - Restrict permission to a specific router</li>
+</ul>
+<p>Example: A custom role could allow <code>cmd</code> permission only for the <code>INST1</code> target.</p>
+<p><img decoding=async loading=lazy alt="Edit Role" src=/tools/staticdocs/assets/images/edit_role-1ea95cfab9edd9173196018fe14ec39ad0537e0c04c8f0f5af53fcf3173867df.png width=1062 height=1228 class=img_JrJa /></p>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=authorization-flow>Authorization Flow<a href=#authorization-flow class=hash-link aria-label="Direct link to Authorization Flow" title="Direct link to Authorization Flow" translate=no></a></h2>
+<p>When a user attempts an action, COSMOS Enterprise performs the following checks:</p>
+<ol>
+<li class=""><strong>Token Validation</strong> - Verify the JWT token from Keycloak</li>
+<li class=""><strong>Role Extraction</strong> - Extract roles from the token's <code>realm_access</code> claim</li>
+<li class=""><strong>Scope Matching</strong> - Match user roles against the requested scope or <code>ALLSCOPES</code></li>
+<li class=""><strong>Permission Check</strong> - Verify the action's required permission is granted by the role</li>
+<li class=""><strong>Resource Matching</strong> - For custom roles, check if specific resources match</li>
+<li class=""><strong>Command Authority</strong> - If applicable, verify command authority for the target</li>
+</ol>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=default-users>Default Users<a href=#default-users class=hash-link aria-label="Direct link to Default Users" title="Direct link to Default Users" translate=no></a></h2>
+<p>COSMOS Enterprise Keycloak realm includes default test users for each role:</p>
+<table><thead><tr><th>Username<th>Password<th>Default Role<th>Email<tbody><tr><td>operator<td>operator<td>DEFAULT__operator<td><a href=mailto:operator@openc3.com target=_blank rel="noopener noreferrer" class="">operator@openc3.com</a><tr><td>runner<td>runner<td>DEFAULT__runner<td><a href=mailto:runner@openc3.com target=_blank rel="noopener noreferrer" class="">runner@openc3.com</a><tr><td>viewer<td>viewer<td>DEFAULT__viewer<td><a href=mailto:viewer@openc3.com target=_blank rel="noopener noreferrer" class="">viewer@openc3.com</a><tr><td>admin<td>admin<td>ALLSCOPES__admin<td><a href=mailto:admin@openc3.com target=_blank rel="noopener noreferrer" class="">admin@openc3.com</a><tr><td>approver<td>approver<td>DEFAULT__approver<td><a href=mailto:approver@openc3.com target=_blank rel="noopener noreferrer" class="">approver@openc3.com</a></table>
+<p><strong>Note:</strong> These are default development/testing accounts. In production deployments, you should configure proper authentication and remove or change these default credentials.</p>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=best-practices>Best Practices<a href=#best-practices class=hash-link aria-label="Direct link to Best Practices" title="Direct link to Best Practices" translate=no></a></h2>
+<ol>
+<li class=""><strong>Principle of Least Privilege</strong> - Assign users the minimum permissions needed for their role</li>
+<li class=""><strong>Use Scopes</strong> - Leverage scopes to separate different missions or projects</li>
+<li class=""><strong>Custom Roles</strong> - Create custom roles for specialized needs rather than giving admin access</li>
+<li class=""><strong>Command Authority</strong> - Enable command authority for production systems to prevent conflicts</li>
+<li class=""><strong>Regular Audits</strong> - Review user roles and permissions periodically</li>
+<li class=""><strong>Production Security</strong> - Replace default credentials and integrate with your organization's SSO/IdP</li>
+</ol>
+<h2 class="anchor anchorTargetStickyNavbar_BQm5" id=managing-roles>Managing Roles<a href=#managing-roles class=hash-link aria-label="Direct link to Managing Roles" title="Direct link to Managing Roles" translate=no></a></h2>
+<h3 class="anchor anchorTargetStickyNavbar_BQm5" id=viewing--assigning-roles-to-users>Viewing / Assigning Roles to Users<a href=#viewing--assigning-roles-to-users class=hash-link aria-label="Direct link to Viewing / Assigning Roles to Users" title="Direct link to Viewing / Assigning Roles to Users" translate=no></a></h3>
+<p>Roles are managed in Keycloak:</p>
+<ol>
+<li class="">Access the Keycloak admin console</li>
+<li class="">Navigate to Users</li>
+<li class="">Select a user</li>
+<li class="">Go to Role Mappings</li>
+<li class="">Assign roles using the <code>{SCOPE}__{ROLE_NAME}</code> format</li>
+</ol>
+<p><img decoding=async loading=lazy alt="Keycloak User Roles" src=/tools/staticdocs/assets/images/keycloak_user_roles-d4c78e2a5d33c4ea3016250d849b3363deccd21b9562561793b81981acf773fe.png width=2980 height=1354 class=img_JrJa /></div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="row margin-top--sm theme-doc-footer-edit-meta-row"><div class="col noPrint_yVnS"><a href=https://github.com/OpenC3/cosmos/tree/main/docs.openc3.com/docs/guides/roles-permissions.md target=_blank rel="noopener noreferrer" class=theme-edit-this-page><svg fill=currentColor height=20 width=20 viewBox="0 0 40 40" class=iconEdit_ilel aria-hidden=true><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"/></g></svg>Edit this page</a></div><div class="col lastUpdated_UZ1E"></div></div></footer></article><nav class="docusaurus-mt-lg pagination-nav" aria-label="Docs pages"><a class="pagination-nav__link pagination-nav__link--prev" href=/tools/staticdocs/docs/guides/reference-architectures><div class=pagination-nav__sublabel>Previous</div><div class=pagination-nav__label>Reference Architectures</div></a><a class="pagination-nav__link pagination-nav__link--next" href=/tools/staticdocs/docs/guides/script-writing><div class=pagination-nav__sublabel>Next</div><div class=pagination-nav__label>Script Writing Guide</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_Ka_U thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href=#overview class="table-of-contents__link toc-highlight">Overview</a><ul><li><a href=#role-naming-convention class="table-of-contents__link toc-highlight">Role Naming Convention</a></ul><li><a href=#built-in-roles class="table-of-contents__link toc-highlight">Built-in Roles</a><ul><li><a href=#admin class="table-of-contents__link toc-highlight">Admin</a><li><a href=#operator class="table-of-contents__link toc-highlight">Operator</a><li><a href=#viewer class="table-of-contents__link toc-highlight">Viewer</a><li><a href=#approver class="table-of-contents__link toc-highlight">Approver</a><li><a href=#runner class="table-of-contents__link toc-highlight">Runner</a></ul><li><a href=#permission-definitions class="table-of-contents__link toc-highlight">Permission Definitions</a><ul><li><a href=#system-permissions class="table-of-contents__link toc-highlight">System Permissions</a><li><a href=#telemetry-permissions class="table-of-contents__link toc-highlight">Telemetry Permissions</a><li><a href=#command-permissions class="table-of-contents__link toc-highlight">Command Permissions</a><li><a href=#script-permissions class="table-of-contents__link toc-highlight">Script Permissions</a><li><a href=#administrative-permissions class="table-of-contents__link toc-highlight">Administrative Permissions</a><li><a href=#approval-permissions class="table-of-contents__link toc-highlight">Approval Permissions</a></ul><li><a href=#command-authority class="table-of-contents__link toc-highlight">Command Authority</a><li><a href=#custom-roles class="table-of-contents__link toc-highlight">Custom Roles</a><ul><li><a href=#creating-custom-roles class="table-of-contents__link toc-highlight">Creating Custom Roles</a><li><a href=#custom-role-permissions class="table-of-contents__link toc-highlight">Custom Role Permissions</a></ul><li><a href=#authorization-flow class="table-of-contents__link toc-highlight">Authorization Flow</a><li><a href=#default-users class="table-of-contents__link toc-highlight">Default Users</a><li><a href=#best-practices class="table-of-contents__link toc-highlight">Best Practices</a><li><a href=#managing-roles class="table-of-contents__link toc-highlight">Managing Roles</a><ul><li><a href=#viewing--assigning-roles-to-users class="table-of-contents__link toc-highlight">Viewing / Assigning Roles to Users</a></ul></ul></div></div></div></div></main></div></div></div><footer class="theme-layout-footer footer footer--dark"><div class="container container-fluid"><div class="row footer__links"><div class="theme-layout-footer-column col footer__col"><div class=footer__title>Homepage</div><ul class="footer__items clean-list"><li class=footer__item><a href=https://openc3.com target=_blank rel="noopener noreferrer" class=footer__link-item>Home</a></ul></div><div class="theme-layout-footer-column col footer__col"><div class=footer__title>Docs</div><ul class="footer__items clean-list"><li class=footer__item><a class=footer__link-item href=/tools/staticdocs/docs>Documentation</a></ul></div><div class="theme-layout-footer-column col footer__col"><div class=footer__title>Community</div><ul class="footer__items clean-list"><li class=footer__item><a href=https://www.linkedin.com/company/openc3 target=_blank rel="noopener noreferrer" class=footer__link-item>LinkedIn<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_IsiZ><use href=#theme-svg-external-link /></svg></a></ul></div><div class="theme-layout-footer-column col footer__col"><div class=footer__title>More</div><ul class="footer__items clean-list"><li class=footer__item><a href=https://github.com/OpenC3/cosmos target=_blank rel="noopener noreferrer" class=footer__link-item>GitHub<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_IsiZ><use href=#theme-svg-external-link /></svg></a><li class=footer__item><a class=footer__link-item href=/tools/staticdocs/docs/privacy>Privacy</a></ul></div></div><div class="footer__bottom text--center"><div class=footer__copyright>Copyright © 2025 OpenC3, Inc.</div></div></div></footer></div></body>