Permissions

This page lists every console permission in Outpost 0.4.1, what it allows, and which built-in roles hold it by default. Use it to choose a role for someone, or to find out why a person can or cannot do something. The roles themselves are described in Roles and permissions.

These are permissions in the console. They do not apply to the Outpost portal, where your plan, payment methods, and invoices are managed.

Scope

• The list is complete for Outpost 0.4.1: 109 permissions. It also lists terminal:layout:manage, which comes with saved terminal layouts, network_map:edit and network_map:manage, which come with network maps, and timesheet:approve, which comes with timesheets.
• The server checks a permission on every request. A section of the navigation you lack the permission for is not shown, and the API refuses the same action with 403 Forbidden and You do not have permission to perform this action. if it is called directly.
• The Owner role holds every permission. A Support Manager holds every permission a Field Technician holds, and a Field Technician holds every permission a Support Rep holds.
• Home Lab has one console user, the owner, and roles cannot be assigned. See Plans and limits.
• A permission for a feature your plan does not include grants nothing. The feature stays locked. See Plan feature reference.

How to read a permission

A permission is a noun and a verb, written noun:verb. The noun is the area of the console, and the verb is what the holder can do there.

Verb	Usually means
read	View the area’s records.
write	Create and change records.
manage	Configure the area itself, such as its settings, structure, or rules.
approve	Make a decision that others then act on, such as approving a script or a patch.
admin	Destructive or high-impact actions in the area.

Some areas have verbs of their own, such as vault:reveal, ticket:assign, and script:run_unapproved. The table rows say exactly what each one allows.

The mode a remote session opens in, such as unattended or consent required, is set by remote access policy. Starting a session needs remote:initiate and the permission for that mode. See Permission for each mode.

Permissions that need care

A few permissions reach further than their area. Grant them deliberately.

Permission	Why
role:manage	Whoever holds it can grant any role, including Owner, to any console user.
remote:unattended	Opens sessions that show the person at the endpoint no prompt, and consent sessions to the sign-in screen.
profile:manage_mandatory	A mandatory value beats every profile rank, so it can hold a whole fleet to one setting.
terminal:layout:manage	An endpoint’s default terminal layout can carry startup commands, which are typed into every technician’s terminal on that endpoint, often as SYSTEM or root.
script:approve	Approving a script signs it, and endpoints check that signature before an unattended run.
script:run_unapproved	Runs a script nobody has approved, except on endpoints where script_execution.approval_required applies.
vault:reveal, bitlocker:reveal	Show a secret in plain text. Each reveal is written to the audit log.
backup:keys	Can switch a client to zero-knowledge backup keys. Without the endpoint’s key or a recovery kit, those backups cannot be recovered. See Backup encryption keys and recovery kits.
mailbox:manage	Holds the credentials to a support mailbox.
storage:manage	Holds storage credentials and decides where files are written.
ticket:admin	Merges and deletes tickets, and edits a ticket’s history.

Endpoints and fleet

Permission	Allows	Built-in roles that hold it
bitlocker:read	List escrowed BitLocker recovery keys and their volumes.	Owner, Support Manager, Field Technician, Support Rep
bitlocker:reveal	Reveal an escrowed BitLocker recovery key.	Owner
catalog:read	Read the settings catalog that profiles are built from.	Owner, Support Manager, Field Technician, Support Rep
compliance:manage	Approve or revoke compliance exceptions, generate evidence packs, and create remediation tickets.	Owner, Support Manager
compliance:read	View compliance posture, gap analysis, exceptions, and evidence packs.	Owner, Support Manager, Field Technician, Support Rep
discovery:deploy	Push-install the agent onto discovered devices.	Owner, Support Manager, Field Technician
discovery:manage	Trust or deny networks, start scans, and ignore or remove discovered devices.	Owner, Support Manager
discovery:read	View discovered networks, devices, suggestions, and deploy jobs.	Owner, Support Manager, Field Technician, Support Rep
endpoint:action	Run endpoint actions such as restart, lock, sign-out, message, kill process, and service control.	Owner, Support Manager, Field Technician
endpoint:read	Read endpoints and their inventory.	Owner, Support Manager, Field Technician, Support Rep
endpoint:write	Create and update endpoints.	Owner, Support Manager, Field Technician
enroll:manage	Issue enrollment tokens and download installers.	Owner, Support Manager, Field Technician
enrollment:manage	Manage enrollment. No action in 0.4.1 checks it.	Owner
identity:manage	Manage sites, groups, and people.	Owner, Support Manager, Field Technician
identity:read	Read sites, groups, and people.	Owner, Support Manager, Field Technician, Support Rep
network_map:edit	Edit documented network diagrams and their proposals, link details, and racks. See Network map permissions.	Owner, Support Manager, Field Technician
network_map:manage	Change the network map style and the icon library.	Owner, Support Manager
policy:read	Read effective policy.	Owner, Support Manager, Field Technician, Support Rep
profile:manage	Manage profiles.	Owner, Support Manager
profile:manage_mandatory	Set mandatory profile settings.	Owner
profile:read	Read profiles.	Owner, Support Manager, Field Technician, Support Rep
tag:manage	Create, edit, and delete custom endpoint tags.	Owner, Support Manager, Field Technician

Remote access and commands

Permission	Allows	Built-in roles that hold it
command:dispatch	Dispatch commands to endpoints. No action in 0.4.1 checks it.	Owner, Support Manager, Field Technician
command:execute	Run commands on endpoints.	Owner, Support Manager, Field Technician
remote:ai_control	Let Pioneer AI control remote sessions: approve a task in which Pioneer AI sees the screen and uses the mouse and keyboard of a session you have open. Also needs ai:use.	Owner, Support Manager, Field Technician, Support Rep
remote:attended	Open remote sessions in the attended mode.	Owner, Support Manager, Field Technician, Support Rep
remote:bypass_consent	Reserved. No action checks it.	Owner
remote:consent	Open remote sessions in the consent required mode.	Owner, Support Manager, Field Technician, Support Rep
remote:escort	Join and leave a remote session as an escort.	Owner, Support Manager, Field Technician
remote:escorted	Open remote sessions in the escorted mode.	Owner, Support Manager, Field Technician, Support Rep
remote:initiate	Start remote sessions. A session also needs the permission for its mode.	Owner, Support Manager, Field Technician, Support Rep
remote:read	Read remote sessions.	Owner, Support Manager, Field Technician, Support Rep
remote:unattended	Open remote sessions in the unattended mode, and consent required sessions to the sign-in screen. Publish shared saved views on the remote access page.	Owner, Support Manager, Field Technician, Support Rep
remote:view_recordings	Play back session recordings.	Owner, Support Manager, Field Technician
terminal:layout:manage	Save and clear an endpoint’s default terminal layout, including the startup commands it runs. See Save and load layouts.	Owner, Support Manager

Software and patching

Permission	Allows	Built-in roles that hold it
patch:approve	Approve and decline patches for the fleet.	Owner, Support Manager
patch:read	Read patch state and compliance.	Owner, Support Manager, Field Technician, Support Rep
software:approve	Approve or deny self-service software requests.	Owner, Support Manager
software:deploy	Install, upgrade, and uninstall software on endpoints.	Owner, Support Manager, Field Technician
software:manage	Create, edit, and retire catalog packages and their installers.	Owner, Support Manager
software:read	Read the software catalog and installed software inventory.	Owner, Support Manager, Field Technician, Support Rep
vuln:read	Read vulnerability findings.	Owner, Support Manager, Field Technician

Scripts and automation

Permission	Allows	Built-in roles that hold it
automation:manage	Manage ticket rules and automations.	Owner, Support Manager
script:approve	Approve and revoke scripts, which signs them for the fleet.	Owner, Support Manager
script:manage	Create, edit, and retire scripts.	Owner, Support Manager, Field Technician
script:read	Read the script library.	Owner, Support Manager, Field Technician, Support Rep
script:run_unapproved	Run a script that has not been approved, except where script_execution.approval_required applies.	Owner, Support Manager, Field Technician
script:schedule	Create and manage script schedules.	Owner, Support Manager, Field Technician

Alerts, reports, and search

Permission	Allows	Built-in roles that hold it
alert:ack	Acknowledge and resolve alerts.	Owner, Support Manager, Field Technician, Support Rep
alert:manage	Create and edit alert rules and notification channels.	Owner, Support Manager
alert:read	Read alerts and alert rules.	Owner, Support Manager, Field Technician, Support Rep
report:manage	Create and edit report definitions.	Owner, Support Manager
report:read	Read and run reports.	Owner, Support Manager, Field Technician
report:schedule	Schedule report delivery.	Owner, Support Manager
search:query	Search across the records the account can already see.	Owner, Support Manager, Field Technician, Support Rep, Accounting, Sales, Project manager

Backup and Outpost Sync

Permission	Allows	Built-in roles that hold it
backup:browse	Browse the files inside backup snapshots.	Owner, Support Manager, Field Technician
backup:keys	Manage backup encryption keys, zero-knowledge mode, and recovery kits.	Owner
backup:manage	Manage backup connectors and links to third-party backup devices.	Owner
backup:read	View backup coverage, status, runs, and snapshots.	Owner, Support Manager, Field Technician, Support Rep, Accounting
backup:restore	Restore and download files from backups, and start a backup.	Owner, Support Manager, Field Technician
sync:files	Browse the files, versions, and recycle bin in a person’s Outpost Sync folder.	Owner
sync:manage	Manage Outpost Sync settings, destinations, and stored files.	Owner
sync:read	View Outpost Sync status, usage, and devices.	Owner, Support Manager, Field Technician

Service desk

Permission	Allows	Built-in roles that hold it
chat:agent	Take live support chats from end users.	Owner, Support Manager, Field Technician, Support Rep
chat:read	Review stored chat transcripts.	Owner, Support Manager
incident:manage	Create and run incidents, maintenance, and postmortems.	Owner, Support Manager
incident:read	Read incidents, components, and status page configuration.	Owner, Support Manager, Field Technician, Support Rep
kb:manage	Write and publish knowledge base articles.	Owner, Support Manager
kb:read	Read knowledge base articles.	Owner, Support Manager, Field Technician, Support Rep
mailbox:manage	Configure support mailboxes and outbound mail, review and release suspended mail, manage client email domains and the sending domain, and set Trust all senders.	Owner
sla:manage	Manage SLA policies, targets, and business schedules.	Owner, Support Manager
statuspage:manage	Configure the public status page.	Owner
ticket:admin	Merge one ticket into another, delete tickets, and edit ticket history.	Owner
ticket:assign	Assign tickets to a technician or group.	Owner, Support Manager, Field Technician, Support Rep
ticket:manage	Manage queues, forms, custom fields, and a client’s Desk settings: statuses, categories and subcategories, the category automatic tickets get, and requester notification emails, including Customize and Revert to MSP defaults. On the MSP plan, it also manages Desk defaults at practice level, which every client follows until it customizes. See Desk settings.	Owner, Support Manager
ticket:read	Read tickets and their conversations, and list the console’s technicians (name and email only) in assignee pickers.	Owner, Support Manager, Field Technician, Support Rep, Project manager
ticket:write	Create tickets, reply, change ticket fields, log time on tickets, verify the sender of a ticket that arrived by email, and make a ticket the child of a parent ticket or remove it from its parent. On the MSP plan, also keep a timesheet and use the timer.	Owner, Support Manager, Field Technician, Support Rep, Project manager

Documentation and credentials

Permission	Allows	Built-in roles that hold it
docs:manage	Manage documentation structure: asset layouts, option lists, connected fields, settings, restrictions, import, and export.	Owner, Support Manager
docs:read	Read documentation articles, assets, domains, vendors, licenses, processes, and their relations.	Owner, Support Manager, Field Technician, Support Rep, Sales, Project manager
docs:write	Create and edit documentation articles and assets, run processes, and upload attachments.	Owner, Support Manager, Field Technician
vault:manage	Manage the vault: collections, restrictions, checkout break-glass, vault policy, and reclaiming personal vaults.	Owner, Support Manager
vault:read	List credentials and their details, without any secret.	Owner, Support Manager, Field Technician, Support Rep
vault:reveal	Reveal a stored credential, read its one-time code, and read its password history.	Owner, Support Manager, Field Technician
vault:rotate	Rotate a credential by hand and configure agent-managed rotation.	Owner, Support Manager
vault:share	Send a credential or an article as a one-time link.	Owner, Support Manager, Field Technician
vault:use	Use a credential in a remote session without seeing it.	Owner, Support Manager, Field Technician
vault:write	Create and edit credentials and collections, and check them out.	Owner, Support Manager, Field Technician

MSP business

Permission	Allows	Built-in roles that hold it
crm:approve	Approve quotes and manage sales settings, branding, and the pipeline.	Owner
crm:read	Read prospects, opportunities, activities, quotes, sales settings, and the sales dashboard.	Owner, Accounting, Sales
crm:send	Send quotes to customers and countersign accepted ones.	Owner, Sales
crm:write	Manage prospects, contacts, opportunities, activities, and draft quotes.	Owner, Sales
project:calendar	Manage appointments and time off on the dispatch calendar, schedule a ticket from the ticket, and see My day.	Owner, Support Manager, Field Technician, Project manager
project:manage	Manage project templates, schedules, change orders, budgets, cost rates, capacity, and settings, and close projects.	Owner, Project manager
project:read	Read projects, phases, tasks, milestones, documents, schedules, and the dispatch calendar.	Owner, Support Manager, Field Technician, Project manager
project:time	Log, edit, and delete time against project tasks.	Owner, Support Manager, Field Technician, Project manager
project:write	Manage projects, phases, tasks, milestones, notes, documents, and ticket links.	Owner, Support Manager, Field Technician, Project manager
psa:admin	Manage client billing settings, the charge catalog, exports, and timesheet categories and daily targets.	Owner
psa:invoice	Finalize, send, and void invoices, and record payments and credit notes.	Owner
psa:read	Read agreements, invoices, unbilled time, and accounts receivable.	Owner, Accounting, Project manager
psa:write	Manage agreements, billing rules, and draft invoices.	Owner
timesheet:approve	Open any technician’s timesheet, add other time to it and change their entries, and approve, return, and reopen timesheets.	Owner, Support Manager, Project manager

Procurement, inventory, and assets

Permission	Allows	Built-in roles that hold it
assets:read	Read the asset register, staff equipment, and warranty status.	Owner, Support Manager, Field Technician, Sales, Purchasing, Integration: sales
assets:write	Manage assets, check staff equipment out and in, and refresh warranty status.	Owner, Support Manager, Field Technician
integrations:admin	Manage distributor and warranty connections, API keys, and outbound webhooks.	Owner
inventory:read	Read stock items, stock locations, stock levels, and stock movements.	Owner, Support Manager, Field Technician, Purchasing, Integration: sales
inventory:write	Manage stock items and locations, adjust stock, transfer it between locations, and deliver sales orders from stock.	Owner, Purchasing
procurement:approve	Approve purchase orders and supplier bills, submit orders to distributors, place subscription orders, and change procurement settings.	Owner, Purchasing
procurement:read	Read suppliers, purchase orders, receipts, supplier bills, returns, and subscriptions.	Owner, Accounting, Sales, Purchasing, Integration: sales
procurement:receive	Receive purchase order deliveries and reverse receipts.	Owner, Purchasing
procurement:write	Create and edit suppliers, purchase orders, supplier bills, and returns.	Owner, Purchasing

See Procurement and assets.

Organization and access

Permission	Allows	Built-in roles that hold it
audit:read	Read the audit logs.	Owner, Support Manager, Field Technician, Support Rep
billing:manage	Change billing settings, including the billing date.	Owner
billing:read	Read billing rollups, including the MSP Storage report.	Owner, Accounting
client:manage	Create and update clients, and change organization settings such as branding.	Owner
client:read	Read clients and organization details.	Owner, Accounting
client:write	Create and update clients. No action in 0.4.1 checks it.	Owner
role:manage	Grant and remove roles.	Owner
storage:manage	Manage storage destinations.	Owner
user:manage	Invite, disable, and enable console users.	Owner, Support Manager

Other

Permission	Allows	Built-in roles that hold it
ai:manage	Manage Pioneer AI settings, shared prompts, AI budgets, and per-client AI access, and view AI usage.	Owner
ai:review	Read every technician’s Pioneer AI conversations, read-only. Each view is audited.	Owner
ai:use	Use Pioneer AI and save personal prompts.	Owner, Support Manager, Field Technician, Support Rep, Accounting, Sales, Project manager
console:extras	Use optional console extras.	Owner, Support Manager, Field Technician, Support Rep, Accounting
feedback:submit	Send feedback, feature requests, and bug reports to Outpost.	Owner, Support Manager, Field Technician, Support Rep, Accounting, Sales, Project manager

Related

• Roles and permissions
• Invite your team
• Plan feature reference
• Audit logs