Skip to main content
Ingestly uses role-based access control (RBAC) to manage what users can do. Each user is assigned a role, and each role has a set of permissions.

​
Built-in roles

Every organization comes with four built-in roles. Built-in roles cannot be edited, renamed, or deleted, but their permissions can be inspected, and they are always available when you invite or assign teammates.
In the roles list at Settings → Roles, built-in (system) roles have their Edit and Delete actions disabled, but the Permissions action remains available. It opens a read-only view where the toggles are disabled and you cannot save (the footer shows a single Close button), so you can review exactly which permissions a built-in role grants without modifying them.
The first person to sign up for an organization becomes an Admin. You can assign any built-in role when you invite a teammate or from the members list. For finer-grained access, create a custom role.
Connectors, API keys, and webhook signing keys are managed by Admins only. The Member, Reviewer, and Viewer roles cannot access these credentials.

​
Permission model

Permissions follow the format Group.Resource.Action. For example, Core.Pipeline.Read grants read access to pipelines.

​
Permission groups

​
Actions

Each resource supports up to four actions:

​
Implied permissions

Some permissions imply others. For example:
  • Core.Pipeline.Update implies Core.Pipeline.Read. You can’t update what you can’t see
  • Core.Pipeline.Delete implies Core.Pipeline.Read
  • Core.Pipeline.Create implies Core.Pipeline.Read
This means you don’t need to explicitly grant Read when granting Create, Update, or Delete.

​
Baseline permissions

A few permissions are granted to every user automatically and cannot be revoked by a role. In the role permissions dialog, these show up as toggles that are always on and cannot be unchecked. Today, the only baseline permission is:
  • Core.Workspace.Read: every user can see the workspaces they belong to.
Baseline permissions are enforced by Ingestly itself, not by the role. You do not need to grant them when creating a custom role, and you cannot take them away.

​
Complete permission reference

​
Core permissions

​
Account permissions

​
API key auth permissions

​
Subscription permissions

​
Creating a custom role

  1. Go to Settings → Roles
  2. Click New Role
  3. Enter a role name
  4. Select the permissions to grant
  5. Click Save
A small number of toggles in the permission grid appear always on and cannot be unchecked. These are baseline permissions that Ingestly grants to every user.
Start with a minimal set of permissions and add more as needed. It’s easier to grant additional access than to revoke it.