---
title: "Network map permissions"
description: "The permissions that let a technician view network maps, edit diagrams, links, and racks, and change map styles and icons, and which built-in roles hold them."
url: "https://support.outpostplatform.com/network-maps/permissions/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "Permissions for Outpost network maps: discovery:read views the map, snapshots, diagrams, racks, styles, and exports; endpoint:read adds endpoints; docs:read compares against documentation files; network_map:edit edits documented diagrams, proposals, link details, and racks; network_map:manage changes styles and icons. Built-in role defaults and what a client's own users see."
availability:
  plans: ["essentials", "enterprise", "msp"]
  permission: "role:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/network-maps/permissions.md"
license: "CC BY 4.0"
---

# Network map permissions

This page lists what each permission allows on network maps, and which
built-in roles hold it. Use it to decide who on your team may edit diagrams
or change your map style. For roles in general, see
[Roles and permissions](/depot/roles-and-permissions/). On Home Lab, the one
console user is the owner and holds every permission.

## Permissions

| Permission | Allows | Held by default |
| --- | --- | --- |
| `discovery:read` | View the network map, its snapshots and changes, trace paths, compare with a diagram file, export, and view documented diagrams, racks, link details, map styles, and icons. | Owner, Support Manager, Field Technician, Support Rep |
| `endpoint:read` | See endpoints on the map. Without it, an endpoint shows as the discovered device it matched, or is left out. | Owner, Support Manager, Field Technician, Support Rep |
| `docs:read` | Compare the map with a .drawio or .vsdx file in the client's documentation. Without it, upload the file instead. | Owner, Support Manager, Field Technician, Support Rep, Sales, Project manager |
| `network_map:edit` | Create, edit, restore, share, and delete documented diagrams, accept and reject proposals, set drift alert thresholds, edit link details, and create, change, and delete racks. | Owner, and every built-in role that holds `docs:write`: Support Manager and Field Technician |
| `network_map:manage` | Change the practice map style, a client's style override, and the icon library. | Owner, and every built-in role that holds `discovery:manage`: Support Manager |

The two `network_map` permissions were added with network maps. A built-in role
you had already narrowed so it lacks `docs:write` or `discovery:manage` does
not get them. Custom roles get neither until you add them.

Saving a Pioneer AI drawing needs `docs:write` for **Save to documentation**,
and `network_map:edit` for **Save as network diagram**.

## What a client's own users see

On the MSP plan, people who sign in to a client's own console see only the
documented diagrams marked **Visible to client**, and only their current
revision. They cannot see earlier revisions or proposals, and cannot change
anything, whatever their role.

## Related

- [Permissions](/reference/permissions/)
- [Network maps](/network-maps/)