Platform
Platform administrators, tenant lifecycle and shared services.
Platform administration permissions apply to the installation, not to an arbitrary selected tenant. A tenant administrator cannot acquire them through a custom tenant role.
The platform.model_preset.* and platform.runtime_profile.read entries are an exception to the scope suggested by their prefix: they describe shared catalogues but are evaluated in the caller's tenant context. They come from inference roles, not automatically from platform administration.
Model deployment uses platform.global_service.manage. An Inference Deployer role is not sufficient for the platform model-installer API. Some entries describe model authority without a dedicated API operation; their descriptions distinguish those cases.
Permissions
This family contains 18 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
platform.admin.assign
Add an eligible user to the protected platform-administrator group.
Add an eligible user to the protected platform-administrator group.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.admin.list |
platform.admin.list
List the platform-administrator roster.
List the platform-administrator roster.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.admin.revoke
Remove a platform-administrator assignment, subject to protected-administrator safeguards.
Remove a platform-administrator assignment, subject to protected-administrator safeguards.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.admin.list |
platform.config.read
Represents platform-configuration read authority in the authorization model.
Represents platform-configuration read authority in the authorization model. It is not a dedicated configuration endpoint.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.config.update
Represents platform-configuration write authority in the authorization model.
Represents platform-configuration write authority in the authorization model. It is not a dedicated configuration endpoint.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.config.read |
platform.global.read
Read platform-level Global administration and model-deployment information.
Read platform-level Global administration and model-deployment information. This does not grant Global tenant membership or general content access.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.global_service.manage
Manage shared platform services, including model-installer download, registration, deployment and removal operations.
Manage shared platform services, including model-installer download, registration, deployment and removal operations.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.global.read |
platform.model_preset.list
Represents discovery of shared model presets in the authorization model.
Represents discovery of shared model presets in the authorization model. Tenant preset API routes use tenant.model_preset permissions.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Inference Deployer, Inference Operator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.model_preset.read |
platform.model_preset.read
Represents read access to shared model presets in the authorization model.
Represents read access to shared model presets in the authorization model. It does not permit editing shared presets.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Inference Deployer, Inference Operator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.runtime_profile.read
Read the platform runtime-profile catalogue when choosing profiles for a tenant.
Read the platform runtime-profile catalogue when choosing profiles for a tenant. The catalogue endpoint also requires tenant.runtime_profile.list.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Inference Deployer, Inference Operator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.tenant.admin.assign
Assign an eligible tenant member as that tenant's administrator through platform administration.
Assign an eligible tenant member as that tenant's administrator through platform administration.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.tenant.admin.list |
platform.tenant.admin.list
List administrator assignments for tenants through platform administration.
List administrator assignments for tenants through platform administration.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.tenant.admin.revoke
Revoke a tenant-administrator assignment through platform administration.
Revoke a tenant-administrator assignment through platform administration.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.tenant.admin.list |
platform.tenant.create
Create a tenant and start its provisioning workflow.
Create a tenant and start its provisioning workflow.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.tenant.list, platform.tenant.read |
platform.tenant.delete
Start tenant deletion.
Start tenant deletion. This is a lifecycle operation, not removal of one user's membership.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.tenant.list, platform.tenant.read, platform.tenant.update |
platform.tenant.list
List the platform-wide tenant registry.
List the platform-wide tenant registry.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.tenant.read |
platform.tenant.read
Read a tenant's platform lifecycle record.
Read a tenant's platform lifecycle record.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
platform.tenant.update
Change a tenant's platform-level configuration through supported tenant-management operations.
Change a tenant's platform-level configuration through supported tenant-management operations.
| Property | Value |
|---|---|
| Scope | Platform |
| Granted by | Platform administrator |
| Custom role | No. Platform permissions are outside tenant custom-role delegation. |
| Also implies | platform.tenant.list, platform.tenant.read |