# Platform (/docs/reference/roles-permissions/platform)



Platform administration permissions apply to the installation, not to an arbitrary selected tenant. A tenant administrator cannot acquire them through a custom tenant role.

The `platform.model_preset.*` and `platform.runtime_profile.read` entries are an exception to the scope suggested by their prefix: they describe shared catalogues but are evaluated in the caller's tenant context. They come from inference roles, not automatically from platform administration.

Model deployment uses `platform.global_service.manage`. An Inference Deployer role is not sufficient for the platform model-installer API. Some entries describe model authority without a dedicated API operation; their descriptions distinguish those cases.

## Permissions [#permissions]

This family contains **18 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### platform.admin.assign [#platformadminassign]

      <span className="catalogue-description">
        Add an eligible user to the protected platform-administrator group.
      </span>
    </summary>

    <div className="catalogue-content">
      Add an eligible user to the protected platform-administrator group.

      | Property     | Value                                                                                           |
      | ------------ | ----------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                        |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                             |
      | Also implies | [platform.admin.list](/docs/reference/roles-permissions/platform#platformadminlist)             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.admin.list [#platformadminlist]

      <span className="catalogue-description">
        List the platform-administrator roster.
      </span>
    </summary>

    <div className="catalogue-content">
      List the platform-administrator roster.

      | Property    | Value                                                                                           |
      | ----------- | ----------------------------------------------------------------------------------------------- |
      | Scope       | Platform                                                                                        |
      | Granted by  | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.admin.revoke [#platformadminrevoke]

      <span className="catalogue-description">
        Remove a platform-administrator assignment, subject to protected-administrator safeguards.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove a platform-administrator assignment, subject to protected-administrator safeguards.

      | Property     | Value                                                                                           |
      | ------------ | ----------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                        |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                             |
      | Also implies | [platform.admin.list](/docs/reference/roles-permissions/platform#platformadminlist)             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.config.read [#platformconfigread]

      <span className="catalogue-description">
        Represents platform-configuration read authority in the authorization model.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents platform-configuration read authority in the authorization model. It is not a dedicated configuration endpoint.

      | Property    | Value                                                                                           |
      | ----------- | ----------------------------------------------------------------------------------------------- |
      | Scope       | Platform                                                                                        |
      | Granted by  | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.config.update [#platformconfigupdate]

      <span className="catalogue-description">
        Represents platform-configuration write authority in the authorization model.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents platform-configuration write authority in the authorization model. It is not a dedicated configuration endpoint.

      | Property     | Value                                                                                           |
      | ------------ | ----------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                        |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                             |
      | Also implies | [platform.config.read](/docs/reference/roles-permissions/platform#platformconfigread)           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.global.read [#platformglobalread]

      <span className="catalogue-description">
        Read platform-level Global administration and model-deployment information.
      </span>
    </summary>

    <div className="catalogue-content">
      Read platform-level Global administration and model-deployment information. This does not grant Global tenant membership or general content access.

      | Property    | Value                                                                                           |
      | ----------- | ----------------------------------------------------------------------------------------------- |
      | Scope       | Platform                                                                                        |
      | Granted by  | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.global\_service.manage [#platformglobal_servicemanage]

      <span className="catalogue-description">
        Manage shared platform services, including model-installer download, registration, deployment and removal operations.
      </span>
    </summary>

    <div className="catalogue-content">
      Manage shared platform services, including model-installer download, registration, deployment and removal operations.

      | Property     | Value                                                                                           |
      | ------------ | ----------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                        |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                             |
      | Also implies | [platform.global.read](/docs/reference/roles-permissions/platform#platformglobalread)           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.model\_preset.list [#platformmodel_presetlist]

      <span className="catalogue-description">
        Represents discovery of shared model presets in the authorization model.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents discovery of shared model presets in the authorization model. Tenant preset API routes use tenant.model\_preset permissions.

      | Property     | Value                                                                                                                                                                            |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                  |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                                                                                                              |
      | Also implies | [platform.model\_preset.read](/docs/reference/roles-permissions/platform#platformmodel_presetread)                                                                               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.model\_preset.read [#platformmodel_presetread]

      <span className="catalogue-description">
        Represents read access to shared model presets in the authorization model.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents read access to shared model presets in the authorization model. It does not permit editing shared presets.

      | Property    | Value                                                                                                                                                                            |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                  |
      | Granted by  | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                                                                                                              |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.runtime\_profile.read [#platformruntime_profileread]

      <span className="catalogue-description">
        Read the platform runtime-profile catalogue when choosing profiles for a tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Read the platform runtime-profile catalogue when choosing profiles for a tenant. The catalogue endpoint also requires tenant.runtime\_profile.list.

      | Property    | Value                                                                                                                                                                            |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                  |
      | Granted by  | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                                                                                                              |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.admin.assign [#platformtenantadminassign]

      <span className="catalogue-description">
        Assign an eligible tenant member as that tenant's administrator through platform administration.
      </span>
    </summary>

    <div className="catalogue-content">
      Assign an eligible tenant member as that tenant's administrator through platform administration.

      | Property     | Value                                                                                            |
      | ------------ | ------------------------------------------------------------------------------------------------ |
      | Scope        | Platform                                                                                         |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator)  |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                              |
      | Also implies | [platform.tenant.admin.list](/docs/reference/roles-permissions/platform#platformtenantadminlist) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.admin.list [#platformtenantadminlist]

      <span className="catalogue-description">
        List administrator assignments for tenants through platform administration.
      </span>
    </summary>

    <div className="catalogue-content">
      List administrator assignments for tenants through platform administration.

      | Property    | Value                                                                                           |
      | ----------- | ----------------------------------------------------------------------------------------------- |
      | Scope       | Platform                                                                                        |
      | Granted by  | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.admin.revoke [#platformtenantadminrevoke]

      <span className="catalogue-description">
        Revoke a tenant-administrator assignment through platform administration.
      </span>
    </summary>

    <div className="catalogue-content">
      Revoke a tenant-administrator assignment through platform administration.

      | Property     | Value                                                                                            |
      | ------------ | ------------------------------------------------------------------------------------------------ |
      | Scope        | Platform                                                                                         |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator)  |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                              |
      | Also implies | [platform.tenant.admin.list](/docs/reference/roles-permissions/platform#platformtenantadminlist) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.create [#platformtenantcreate]

      <span className="catalogue-description">
        Create a tenant and start its provisioning workflow.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a tenant and start its provisioning workflow.

      | Property     | Value                                                                                                                                                                        |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                                                                                                     |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator)                                                                              |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                                                                                                          |
      | Also implies | [platform.tenant.list](/docs/reference/roles-permissions/platform#platformtenantlist), [platform.tenant.read](/docs/reference/roles-permissions/platform#platformtenantread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.delete [#platformtenantdelete]

      <span className="catalogue-description">
        Start tenant deletion.
      </span>
    </summary>

    <div className="catalogue-content">
      Start tenant deletion. This is a lifecycle operation, not removal of one user's membership.

      | Property     | Value                                                                                                                                                                                                                                                                   |
      | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                                                                                                                                                                                                |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator)                                                                                                                                                                         |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                                                                                                                                                                                                     |
      | Also implies | [platform.tenant.list](/docs/reference/roles-permissions/platform#platformtenantlist), [platform.tenant.read](/docs/reference/roles-permissions/platform#platformtenantread), [platform.tenant.update](/docs/reference/roles-permissions/platform#platformtenantupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.list [#platformtenantlist]

      <span className="catalogue-description">
        List the platform-wide tenant registry.
      </span>
    </summary>

    <div className="catalogue-content">
      List the platform-wide tenant registry.

      | Property     | Value                                                                                           |
      | ------------ | ----------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                        |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                             |
      | Also implies | [platform.tenant.read](/docs/reference/roles-permissions/platform#platformtenantread)           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.read [#platformtenantread]

      <span className="catalogue-description">
        Read a tenant's platform lifecycle record.
      </span>
    </summary>

    <div className="catalogue-content">
      Read a tenant's platform lifecycle record.

      | Property    | Value                                                                                           |
      | ----------- | ----------------------------------------------------------------------------------------------- |
      | Scope       | Platform                                                                                        |
      | Granted by  | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator) |
      | Custom role | No. Platform permissions are outside tenant custom-role delegation.                             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### platform.tenant.update [#platformtenantupdate]

      <span className="catalogue-description">
        Change a tenant's platform-level configuration through supported tenant-management operations.
      </span>
    </summary>

    <div className="catalogue-content">
      Change a tenant's platform-level configuration through supported tenant-management operations.

      | Property     | Value                                                                                                                                                                        |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Platform                                                                                                                                                                     |
      | Granted by   | [Platform administrator](/docs/reference/roles-permissions/system-roles#platform-administrator)                                                                              |
      | Custom role  | No. Platform permissions are outside tenant custom-role delegation.                                                                                                          |
      | Also implies | [platform.tenant.list](/docs/reference/roles-permissions/platform#platformtenantlist), [platform.tenant.read](/docs/reference/roles-permissions/platform#platformtenantread) |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)