Roles & Permissions Reference#

Complete reference for the Reply CMP RBAC model — all roles, their permissions, assignment rules, caching behaviour, and security guarantees.

Permission Format#

All permissions in Reply CMP follow the pattern:

Module.Resource / Action

Examples:

  • FinOps.Cost / Read — read cost data in FinOps

  • Discovery.Resource / Write — create/modify resources in Discovery

  • Onboarding.Connection / Delete — delete cloud connections

Built-in Roles#

Three built-in roles cover the most common access patterns:

Role

Scope

Summary

Owner

Tenant

Full access to all modules + RBAC management (assign/revoke roles)

Contributor

Tenant

Full access to all modules; cannot manage RBAC

Reader

Tenant

Read-only access to all modules

Module-specific Roles#

Module roles allow granular elevation for specific platform areas:

Role

Module

Permissions

Discovery Contributor

Discovery

Discovery.Resource / Read, Write, Delete

Discovery Reader

Discovery

Discovery.Resource / Read

FinOps Contributor

FinOps

FinOps.Cost / Read, Write; FinOps.Dashboard / Read, Write, Delete; FinOps.Budget / Read, Write, Delete; FinOps.Report / Read, Write, Delete

FinOps Reader

FinOps

All FinOps resources / Read only

Provisioning Contributor

Provisioning

Provisioning.Deployment / Read, Write, Delete

Provisioning Reader

Provisioning

Provisioning.Deployment / Read

Policy Contributor

Automation

Policy.Policy / Read, Write, Delete; Policy.Execution / Read

Policy Reader

Automation

Policy.Policy / Read; Policy.Execution / Read

Monitoring Contributor

Monitoring

Monitoring.Dashboard / Read, Write

Monitoring Reader

Monitoring

Monitoring.Dashboard / Read

Tenant Reader

Tenant

Onboarding.Tenant / Read

User Administrator

Users

Onboarding.User / Read, Write (limited by superset rule)

Permission Domains#

All permission domains in the platform:

Domain

Resources

Actions available

Discovery

Resource

Read, Write, Delete

FinOps

Cost, Dashboard, Budget, Report, Allocation

Read, Write, Delete

Provisioning

Deployment

Read, Write, Delete

Policy

Policy, Execution

Read, Write, Delete

Monitoring

Dashboard

Read, Write

Onboarding

Tenant, Connection, User, Quota, Report

Read, Write, Delete

MCP

AI agent tools

Various (per-tool access control)

Assignment Rules#

Superset rule: You can only assign roles whose combined permissions are a subset of your own. This prevents privilege escalation through delegation.

  • A FinOps Reader cannot assign the FinOps Contributor role to another user.

  • A Contributor can assign any non-Owner role.

Self-operation prohibition: You cannot assign roles to yourself, nor revoke your own roles. This requires a second administrator.

Scope: Roles are tenant-scoped. A user’s roles apply to the entire tenant — there are no per-group or per-resource role assignments.

Multiple roles: A user can hold any number of roles simultaneously. Effective permissions are the union of all assigned roles.

Caching#

For performance, role assignments and effective permission sets are cached:

Cache

Duration

Notes

Role assignments

30 minutes (5-minute sliding window)

After assigning a new role, it may take up to 30 min to take effect

Role definitions

24 hours

Role definitions rarely change

Note

If you need a permission to take effect immediately (e.g., for a new user who needs urgent access), ask the user to log out and log back in — this invalidates their session cache.

CMP Agent (MCP Tool) Permissions#

The 11 MCP tools used by the CMP Agent are permission-gated. Each tool requires one or more standard permissions. The mapping is enforced automatically — users who lack the required permission will not have that tool available to the Agent when they chat.

Example: QueryRawDataTool requires FinOps.Cost / Read. A Discovery-only user cannot query cost data through the CMP Agent.