Roles & Permissions

Role-based access control (RBAC) determines what a member can read and manage. A role contains permissions and the resources to which they apply. Members with multiple roles receive their combined permissions.

Permission Hierarchy

Permissions follow the organization hierarchy: Tenant, Division, and Environment. Each level has its own permissions. Scope determines which resources receive those permissions.

The Senior Developer example grants deployment management in Staging and read-only access in Production. It also grants only read access in Data Engineering. One role expresses these differences through division and environment overrides.

How Scoping Works

A role defines defaults for the whole tenant and overrides for selected resources. An override replaces that role's default at its scope. Permissions from separate roles still combine.

Global Scope

Three fields provide tenant-wide defaults:

• tenant grants access to tenant information, members, roles, billing, and configuration.
• division supplies the default permissions for every division.
• environment supplies the default permissions for every environment in every division.

For example, grant deployment:read in global environment to permit reading across all environments. A role with full grants at all three levels can manage the whole tenant.

Per-Division Scope

A division override replaces the role's defaults for that division. Other divisions retain the global defaults. For example, grant full access in Platform Engineering and read-only access in Data Engineering.

Per-Environment Scope (within a Division)

A division override can contain defaults for its environments and overrides for individual environments. An overridden environment uses its specific grants. Other environments in that division use the division's environment defaults. For example, permit deployment management in Production and only reading in Staging.

Scoping Examples

Tenant Permissions

Tenant permissions apply across the tenant's divisions and environments:

Division Permissions

Global division grants apply to every division. A division-specific grant applies only to the named division.

Environment Permissions

Environment grants control deployments and their services. They can apply globally, to every environment in one division, or to one environment.

Every permission has read and manage variants. Manage includes read.

Built-in System Roles

Every tenant includes four system roles. They cannot be deleted. Copy and customize them through Custom Roles.

System roles populate global environment by default. When a division is created, the platform also creates their per-division environment grants. Members therefore retain access in the new division without manual changes.

The tenant owner is the user who founded the tenant. Ownership is stored on the tenant, separately from roles. The owner can disable protection and delete the tenant regardless of their assigned role.

Access Denied After Creating a Deployment

Cloud permissions, Iggy users, and managed-data grants are separate. An Admin label in account Settings is not the same field as an organization role. Iggy credentials do not grant permission to a Console page.

The relevant Cloud permissions belong to the environment that contains the deployment:

The built-in organization admin role includes these permissions. A newly created organization's founder receives that role. In Roles, inspect the Environment permissions and any division or environment overrides. Permission labels shown as words in the Console map to the API names above.

If you are the owner and only administrator, an access denial is not resolved by asking a nonexistent second administrator. Reload the Console and sign in again to obtain a fresh session. If the denial remains, contact LaserData with the organization, environment, deployment ID, timestamp, and correlation ID if available. Do not provide passwords, tokens, or API keys.

An access rule controls network reachability and cannot fix a Cloud permission denial. A higher organization plan or paid deployment is not a remedy for an incorrect role assignment.

Custom Roles

From the Console

1. Open the tenant's Roles page.
2. Click Create Role.
3. Enter a role name.
4. Set tenant permissions, which always apply globally.
5. Set default division permissions.
6. Set default environment permissions.
7. If a division needs different grants, select it and set its division and environment defaults.
8. If an environment needs different grants, add its override within that division.
9. Save the role.

Assigning Roles

Assign roles in an invitation or after a member joins. Members can hold multiple roles. Changes apply on their next request.

Plan Limits

API Reference

Get Role Details

curl https://api.laserdata.cloud/tenants/{tenant_id}/roles/{role_id} \
  -H "ld-api-key: YOUR_API_KEY"

The response contains the role's permissions and scope overrides.

Get Role Members

curl "https://api.laserdata.cloud/tenants/{tenant_id}/roles/{role_id}/members?page=1&results=10" \
  -H "ld-api-key: YOUR_API_KEY"

Invite a Member

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/invitations \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "roles": [123]
  }'

List Members

curl "https://api.laserdata.cloud/tenants/{tenant_id}/members?page=1&results=10" \
  -H "ld-api-key: YOUR_API_KEY"

{
  "items": [
    {
      "id": 1,
      "email": "[email protected]",
      "name": "Jane Smith",
      "active": true,
      "roles": ["admin"],
      "created_at": "2025-01-15T10:30:00Z"
    }
  ],
  "page": 1,
  "total_results": 1,
  "total_pages": 1
}

Update a Member

curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/members/{member_id} \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "active": true,
    "roles": [123, 456]
  }'

Remove a Member

curl -X DELETE https://api.laserdata.cloud/tenants/{tenant_id}/members/{member_id} \
  -H "ld-api-key: YOUR_API_KEY"

Create a Custom Role

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/roles \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "developer",
    "permissions": {
      "tenant": ["info:read", "member:read", "division:read"],
      "division": ["environment:read", "environment:manage"],
      "divisions": {
        "1": {
          "permissions": ["environment:read"],
          "environment": ["deployment:read", "deployment:manage"],
          "environments": {
            "2": ["deployment:read", "deployment:manage", "deployment:telemetry:read"]
          }
        }
      }
    }
  }'

List Roles

curl "https://api.laserdata.cloud/tenants/{tenant_id}/roles?page=1&results=10" \
  -H "ld-api-key: YOUR_API_KEY"

{
  "items": [
    {
      "id": 1,
      "name": "admin",
      "kind": "system"
    },
    {
      "id": 2,
      "name": "developer",
      "kind": "custom"
    }
  ],
  "page": 1,
  "total_results": 2,
  "total_pages": 1
}

Assign Members to a Role

curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/roles/{role_id}/members/assign \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "members": [1, 2, 3]
  }'

Revoke Members from a Role

curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/roles/{role_id}/members/revoke \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "members": [1]
  }'

Delete a Role

curl -X DELETE https://api.laserdata.cloud/tenants/{tenant_id}/roles/{role_id} \
  -H "ld-api-key: YOUR_API_KEY"

List Invitations

curl "https://api.laserdata.cloud/tenants/{tenant_id}/invitations?page=1&results=10" \
  -H "ld-api-key: YOUR_API_KEY"

Delete an Invitation

curl -X DELETE https://api.laserdata.cloud/tenants/{tenant_id}/invitations/{invitation_id} \
  -H "ld-api-key: YOUR_API_KEY"