Summary

The Infisical permissions system is based on a role-based access control (RBAC) model. The system allows you to define roles and assign them to users and machines. Each role has a set of permissions that define what actions a user can perform.

Permissions are built on a subject-action-object model. The subject is the resource permission is being applied to, the action is what the permission allows. An example of a subject/action combination would be secrets/read. This permission allows the subject to read secrets.

Currently Infisical supports 4 actions:

  1. read, allows the subject to read the object.
  2. create, allows the subject to create the object.
  3. edit, allows the subject to edit the object.
  4. delete, allows the subject to delete the object.

Most subjects support all 4 actions, but some subjects only support a subset of actions. Please view the table below for a list of subjects and the actions they support.

Subjects and Actions

Not all actions are applicable to all subjects. As an example, the secrets-rollback subject only supports read, and create as actions. While secrets support read, create, edit, delete.

SubjectActions
secretsread, create, edit, delete
secret-approvalread, create, edit, delete
secret-rotationread, create, edit, delete
secret-rollbackread, create
memberread, create, edit, delete
groupsread, create, edit, delete
roleread, create, edit, delete
integrationsread, create, edit, delete
webhooksread, create, edit, delete
identityread, create, edit, delete
service-tokensread, create, edit, delete
settingsread, create, edit, delete
environmentsread, create, edit, delete
tagsread, create, edit, delete
audit-logsread, create, edit, delete
ip-allowlistread, create, edit, delete
certificate-authoritiesread, create, edit, delete
certificatesread, create, edit, delete
certificate-templatesread, create, edit, delete
pki-alertsread, create, edit, delete
pki-collectionsread, create, edit, delete
workspaceedit, delete
kmsedit

These details are especially useful if you’re using the API to create new project roles. The rules outlined on this page, also apply when using our Terraform Provider to manage your Infisical project roles, or any other of our clients that manage project roles.

Was this page helpful?