Permissions Matrix

This page is the centralized permission reference for CAIP Web Portal features.

How to read this table

Y = action is available in the portal context
N = action is not available in the portal context
In the feature table, permissions are shown as C/R/U/D inside each role column.
The feature matrix below applies after a user is inside a Space context.
Effective access can vary by assigned scopes and environment configuration.
Scope options are exposed by GET /v1/scopes/catalog.

Pre-Space Actions (Service Request)

Space creation is a pre-space lifecycle action, so Owner/Member roles do not apply yet.

Action	Who Can Do It	Outcome
Raise Space Creation Request	Any portal user	A new Space is provisioned via Service Request, and the requester becomes the Space Owner.

Currently, space creation is allowed only via Service Request. Soon, users will be able to raise a new space request directly from the portal.

Feature	Owner (C/R/U/D)	Member (C/R/U/D)	Notes
Spaces	N/Y/Y/N	N/Y/N/N	Space creation is handled via Service Request before Space context. In-space actions cover view/update only.
Members	Y/Y/Y/Y	N/Y/N/N	Member management is owner-only in Identity & Access.
M2M Clients	Y/Y/Y/Y	Y/Y/Y/Y	Member operations depend on assigned scopes.
API Keys	Y/Y/Y/Y	Y/Y/Y/Y	Member operations depend on assigned scopes.
Agent Management	Y/Y/Y/Y	Y/Y/Y/Y	Agent metadata CRUD in portal.
CDH Links	Y/Y/Y/Y	Y/Y/Y/Y	Link management is available to owner/member roles.
Cost	N/Y/N/N	N/Y/N/N	Visibility and analytics only.
Model Catalog	N/Y/N/N	N/Y/N/N	Browse and compare models only.

Scope catalog endpoint: GET /v1/scopes/catalog
Portal behavior should follow assigned scopes and role mappings deployed in the active environment.
Permissions can vary by environment rollout and policy configuration.