# Tenant (/docs/reference/roles-permissions/tenant)



Tenant permissions apply only to the selected tenant. Membership is required even when the user has a role assignment. Ordinary group and role administration cannot modify protected administrator groups.

Current members can read embedding and Service Desk settings and list tenant members and groups without a functional role. These baseline reads support uploads and collaboration; they do not grant administrative writes or Portal Administration entry.

Tenant administrators receive the administration permissions below, but not every functional permission. In particular, model-preset and allowed-runtime-profile permissions come from inference roles or eligible custom-role grants.

`tenant.role.assign` assigns functional roles, not tenant administrators. Use the separate `tenant.admin.*` operations for protected administrator assignments.

## Permissions [#permissions]

This family contains **46 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### tenant.admin.assign [#tenantadminassign]

      <span className="catalogue-description">
        Assign an eligible current member as a tenant administrator.
      </span>
    </summary>

    <div className="catalogue-content">
      Assign an eligible current member as a tenant administrator. This is separate from functional-role assignment.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | No. Custom roles must not grant tenant-administrator authority.                             |
      | Also implies | [tenant.admin.list](/docs/reference/roles-permissions/tenant#tenantadminlist)               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.admin.list [#tenantadminlist]

      <span className="catalogue-description">
        Inspect the selected tenant's protected administrator roster.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect the selected tenant's protected administrator roster.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | No. Administrator management remains outside custom-role delegation.                        |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.admin.revoke [#tenantadminrevoke]

      <span className="catalogue-description">
        Revoke a tenant-administrator assignment, subject to administrator-target safeguards.
      </span>
    </summary>

    <div className="catalogue-content">
      Revoke a tenant-administrator assignment, subject to administrator-target safeguards.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | No. Custom roles must not revoke tenant-administrator authority.                            |
      | Also implies | [tenant.admin.list](/docs/reference/roles-permissions/tenant#tenantadminlist)               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.authentication.read [#tenantauthenticationread]

      <span className="catalogue-description">
        Inspect the tenant's authentication and identity-provider configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect the tenant's authentication and identity-provider configuration.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.authentication.update [#tenantauthenticationupdate]

      <span className="catalogue-description">
        Change the tenant's authentication or federation configuration through supported identity operations.
      </span>
    </summary>

    <div className="catalogue-content">
      Change the tenant's authentication or federation configuration through supported identity operations.

      | Property     | Value                                                                                           |
      | ------------ | ----------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                 |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)     |
      | Custom role  | Yes                                                                                             |
      | Also implies | [tenant.authentication.read](/docs/reference/roles-permissions/tenant#tenantauthenticationread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.branding.read [#tenantbrandingread]

      <span className="catalogue-description">
        Represents branding-read authority derived from tenant administration or branding update.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents branding-read authority derived from tenant administration or branding update. It is not independently assignable in a custom role.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | No. Computed from tenant administration or branding update; no direct custom-role grant.    |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.branding.update [#tenantbrandingupdate]

      <span className="catalogue-description">
        Change or reset tenant theme settings and upload or remove its logo.
      </span>
    </summary>

    <div className="catalogue-content">
      Change or reset tenant theme settings and upload or remove its logo.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.branding.read](/docs/reference/roles-permissions/tenant#tenantbrandingread)         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.embedding.read [#tenantembeddingread]

      <span className="catalogue-description">
        Inspect embedding configuration and available embedding choices.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect embedding configuration and available embedding choices.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.embedding.update [#tenantembeddingupdate]

      <span className="catalogue-description">
        Change embedding configuration or delete an eligible inactive embedding collection.
      </span>
    </summary>

    <div className="catalogue-content">
      Change embedding configuration or delete an eligible inactive embedding collection. Configuration changes also require tenant.update; starting reindexing also requires tenant.reindex.start.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.embedding.read](/docs/reference/roles-permissions/tenant#tenantembeddingread)       |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.group.create [#tenantgroupcreate]

      <span className="catalogue-description">
        Create an ordinary group inside the tenant's managed group hierarchy.
      </span>
    </summary>

    <div className="catalogue-content">
      Create an ordinary group inside the tenant's managed group hierarchy.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.group.list](/docs/reference/roles-permissions/tenant#tenantgrouplist)               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.group.delete [#tenantgroupdelete]

      <span className="catalogue-description">
        Delete an ordinary tenant group.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete an ordinary tenant group. Protected administration groups are excluded.

      | Property     | Value                                                                                                                                                            |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                  |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)                                                                      |
      | Custom role  | Yes                                                                                                                                                              |
      | Also implies | [tenant.group.list](/docs/reference/roles-permissions/tenant#tenantgrouplist), [tenant.group.update](/docs/reference/roles-permissions/tenant#tenantgroupupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.group.list [#tenantgrouplist]

      <span className="catalogue-description">
        Inspect the tenant's group directory.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect the tenant's group directory. The combined identity-directory view also requires tenant.member.list.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.group.member\_manage [#tenantgroupmember_manage]

      <span className="catalogue-description">
        Add or remove members of ordinary tenant groups, subject to group-target restrictions.
      </span>
    </summary>

    <div className="catalogue-content">
      Add or remove members of ordinary tenant groups, subject to group-target restrictions.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.group.list](/docs/reference/roles-permissions/tenant#tenantgrouplist)               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.group.update [#tenantgroupupdate]

      <span className="catalogue-description">
        Update an ordinary tenant group.
      </span>
    </summary>

    <div className="catalogue-content">
      Update an ordinary tenant group.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.group.list](/docs/reference/roles-permissions/tenant#tenantgrouplist)               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.member.add [#tenantmemberadd]

      <span className="catalogue-description">
        Add an existing identity to the tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Add an existing identity to the tenant.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.member.list](/docs/reference/roles-permissions/tenant#tenantmemberlist)             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.member.create\_local [#tenantmembercreate_local]

      <span className="catalogue-description">
        Create a local identity in the tenant where local-user creation is permitted by its identity configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a local identity in the tenant where local-user creation is permitted by its identity configuration.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.member.list [#tenantmemberlist]

      <span className="catalogue-description">
        Inspect tenant members.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect tenant members. The combined identity-directory view also requires tenant.group.list.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.member.remove [#tenantmemberremove]

      <span className="catalogue-description">
        Remove an ordinary tenant membership without deleting the identity from the entire platform.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove an ordinary tenant membership without deleting the identity from the entire platform.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.member.list](/docs/reference/roles-permissions/tenant#tenantmemberlist)             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.model\_preset.create [#tenantmodel_presetcreate]

      <span className="catalogue-description">
        Create a model preset in the tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a model preset in the tenant.

      | Property     | Value                                                                                                                                                                                      |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                                                            |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer)                                                                                                    |
      | Custom role  | Yes                                                                                                                                                                                        |
      | Also implies | [tenant.model\_preset.list](/docs/reference/roles-permissions/tenant#tenantmodel_presetlist), [tenant.model\_preset.read](/docs/reference/roles-permissions/tenant#tenantmodel_presetread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.model\_preset.delete [#tenantmodel_presetdelete]

      <span className="catalogue-description">
        Delete a tenant model preset.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete a tenant model preset.

      | Property     | Value                                                                                                                                                                                                                                                                                        |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                                                                              |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer)                                                                                                                                                                                                      |
      | Custom role  | Yes                                                                                                                                                                                                                                                                                          |
      | Also implies | [tenant.model\_preset.list](/docs/reference/roles-permissions/tenant#tenantmodel_presetlist), [tenant.model\_preset.read](/docs/reference/roles-permissions/tenant#tenantmodel_presetread), [tenant.model\_preset.update](/docs/reference/roles-permissions/tenant#tenantmodel_presetupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.model\_preset.list [#tenantmodel_presetlist]

      <span className="catalogue-description">
        List tenant model presets and their available choices.
      </span>
    </summary>

    <div className="catalogue-content">
      List tenant model presets and their available choices.

      | Property     | Value                                                                                                                                                                            |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                  |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role  | Yes                                                                                                                                                                              |
      | Also implies | [tenant.model\_preset.read](/docs/reference/roles-permissions/tenant#tenantmodel_presetread)                                                                                     |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.model\_preset.read [#tenantmodel_presetread]

      <span className="catalogue-description">
        Read a tenant model preset's configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Read a tenant model preset's configuration.

      | Property    | Value                                                                                                                                                                            |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                  |
      | Granted by  | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role | Yes                                                                                                                                                                              |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.model\_preset.update [#tenantmodel_presetupdate]

      <span className="catalogue-description">
        Edit an existing tenant model preset.
      </span>
    </summary>

    <div className="catalogue-content">
      Edit an existing tenant model preset.

      | Property     | Value                                                                                                                                                                                      |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                                                            |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer)                                                                                                    |
      | Custom role  | Yes                                                                                                                                                                                        |
      | Also implies | [tenant.model\_preset.list](/docs/reference/roles-permissions/tenant#tenantmodel_presetlist), [tenant.model\_preset.read](/docs/reference/roles-permissions/tenant#tenantmodel_presetread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.provider.manage [#tenantprovidermanage]

      <span className="catalogue-description">
        Add, edit or delete web-search provider configurations and replace their credentials.
      </span>
    </summary>

    <div className="catalogue-content">
      Add, edit or delete web-search provider configurations and replace their credentials.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.provider.read](/docs/reference/roles-permissions/tenant#tenantproviderread)         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.provider.read [#tenantproviderread]

      <span className="catalogue-description">
        List or inspect the tenant's web-search provider configurations without revealing stored secrets.
      </span>
    </summary>

    <div className="catalogue-content">
      List or inspect the tenant's web-search provider configurations without revealing stored secrets.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.read [#tenantread]

      <span className="catalogue-description">
        Read the selected tenant context.
      </span>
    </summary>

    <div className="catalogue-content">
      Read the selected tenant context. This is baseline membership access, not permission to administer the tenant.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.reindex.cancel [#tenantreindexcancel]

      <span className="catalogue-description">
        Cancel the tenant's active reindex operation.
      </span>
    </summary>

    <div className="catalogue-content">
      Cancel the tenant's active reindex operation.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.reindex.read](/docs/reference/roles-permissions/tenant#tenantreindexread)           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.reindex.read [#tenantreindexread]

      <span className="catalogue-description">
        Inspect the progress and result of the tenant's reindex operation.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect the progress and result of the tenant's reindex operation.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.reindex.start [#tenantreindexstart]

      <span className="catalogue-description">
        Start reindexing tenant documents into the configured target collection.
      </span>
    </summary>

    <div className="catalogue-content">
      Start reindexing tenant documents into the configured target collection. The endpoint also requires tenant.embedding.update.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.reindex.read](/docs/reference/roles-permissions/tenant#tenantreindexread)           |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.role.assign [#tenantroleassign]

      <span className="catalogue-description">
        Assign a system or custom role to eligible tenant users or groups.
      </span>
    </summary>

    <div className="catalogue-content">
      Assign a system or custom role to eligible tenant users or groups. This does not grant tenant membership or administrator status.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.role.list](/docs/reference/roles-permissions/tenant#tenantrolelist)                 |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.role.create [#tenantrolecreate]

      <span className="catalogue-description">
        Create a tenant-owned custom role.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a tenant-owned custom role. System-role definitions cannot be created through this operation.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.role.list](/docs/reference/roles-permissions/tenant#tenantrolelist)                 |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.role.delete [#tenantroledelete]

      <span className="catalogue-description">
        Delete a custom role and schedule removal of its grants.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete a custom role and schedule removal of its grants. System roles cannot be deleted.

      | Property     | Value                                                                                                                                                        |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                              |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)                                                                  |
      | Custom role  | Yes                                                                                                                                                          |
      | Also implies | [tenant.role.list](/docs/reference/roles-permissions/tenant#tenantrolelist), [tenant.role.update](/docs/reference/roles-permissions/tenant#tenantroleupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.role.list [#tenantrolelist]

      <span className="catalogue-description">
        Inspect system and custom roles, their direct assignments, and the custom-role permission catalogue.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect system and custom roles, their direct assignments, and the custom-role permission catalogue.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.role.revoke [#tenantrolerevoke]

      <span className="catalogue-description">
        Remove a direct system or custom role assignment.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove a direct system or custom role assignment. Independent grants and group-inherited access remain effective.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.role.list](/docs/reference/roles-permissions/tenant#tenantrolelist)                 |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.role.update [#tenantroleupdate]

      <span className="catalogue-description">
        Change a custom role's name, description or permission bundle.
      </span>
    </summary>

    <div className="catalogue-content">
      Change a custom role's name, description or permission bundle. System-role definitions remain read-only.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.role.list](/docs/reference/roles-permissions/tenant#tenantrolelist)                 |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.runtime\_profile.create [#tenantruntime_profilecreate]

      <span className="catalogue-description">
        Add a platform runtime profile to the tenant's allowed set.
      </span>
    </summary>

    <div className="catalogue-content">
      Add a platform runtime profile to the tenant's allowed set. This does not create a new platform compute profile.

      | Property     | Value                                                                                                                                                                                                  |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                                                                        |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer)                                                                                                                |
      | Custom role  | Yes                                                                                                                                                                                                    |
      | Also implies | [tenant.runtime\_profile.list](/docs/reference/roles-permissions/tenant#tenantruntime_profilelist), [tenant.runtime\_profile.read](/docs/reference/roles-permissions/tenant#tenantruntime_profileread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.runtime\_profile.delete [#tenantruntime_profiledelete]

      <span className="catalogue-description">
        Remove a runtime profile from the tenant's allowed set without deleting the platform profile.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove a runtime profile from the tenant's allowed set without deleting the platform profile.

      | Property     | Value                                                                                                                                                                                                                                                                                                          |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                                                                                                |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer)                                                                                                                                                                                                                        |
      | Custom role  | Yes                                                                                                                                                                                                                                                                                                            |
      | Also implies | [tenant.runtime\_profile.list](/docs/reference/roles-permissions/tenant#tenantruntime_profilelist), [tenant.runtime\_profile.read](/docs/reference/roles-permissions/tenant#tenantruntime_profileread), [tenant.runtime\_profile.update](/docs/reference/roles-permissions/tenant#tenantruntime_profileupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.runtime\_profile.list [#tenantruntime_profilelist]

      <span className="catalogue-description">
        List runtime profiles allowed for the tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      List runtime profiles allowed for the tenant. Reading the platform catalogue additionally requires platform.runtime\_profile.read.

      | Property     | Value                                                                                                                                                                            |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                  |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role  | Yes                                                                                                                                                                              |
      | Also implies | [tenant.runtime\_profile.read](/docs/reference/roles-permissions/tenant#tenantruntime_profileread)                                                                               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.runtime\_profile.read [#tenantruntime_profileread]

      <span className="catalogue-description">
        Represents profile-read authority implied by tenant.runtime_profile.list; it is not a separately assignable custom-role permission.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents profile-read authority implied by tenant.runtime\_profile.list; it is not a separately assignable custom-role permission.

      | Property    | Value                                                                                                                                                                            |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                  |
      | Granted by  | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer), [Inference Operator](/docs/reference/roles-permissions/system-roles#inference-operator) |
      | Custom role | No. Computed from runtime-profile list; no direct custom-role grant.                                                                                                             |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.runtime\_profile.update [#tenantruntime_profileupdate]

      <span className="catalogue-description">
        Represents profile-update authority derived from Inference Deployer or tenant.runtime_profile.delete.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents profile-update authority derived from Inference Deployer or tenant.runtime\_profile.delete. Allowed-profile changes use the add/remove API operations.

      | Property     | Value                                                                                                                                                                                                  |
      | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
      | Scope        | Selected tenant                                                                                                                                                                                        |
      | Granted by   | [Inference Deployer](/docs/reference/roles-permissions/system-roles#inference-deployer)                                                                                                                |
      | Custom role  | No. Computed from inference deployer or runtime-profile delete; no direct custom-role grant.                                                                                                           |
      | Also implies | [tenant.runtime\_profile.list](/docs/reference/roles-permissions/tenant#tenantruntime_profilelist), [tenant.runtime\_profile.read](/docs/reference/roles-permissions/tenant#tenantruntime_profileread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.service.manage [#tenantservicemanage]

      <span className="catalogue-description">
        Represents tenant service-installation authority in the authorization model.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents tenant service-installation authority in the authorization model. It does not grant the platform-wide model-installer permission.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | No. Service installation remains tenant-administrator authority.                            |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.service\_desk.read [#tenantservice_deskread]

      <span className="catalogue-description">
        Read the private Service Desk section of tenant configuration, including its Agent and folder bindings.
      </span>
    </summary>

    <div className="catalogue-content">
      Read the private Service Desk section of tenant configuration, including its Agent and folder bindings. The separate public Service Desk metadata route uses tenant.read.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.service\_desk.update [#tenantservice_deskupdate]

      <span className="catalogue-description">
        Change the tenant's Service Desk Agent, retrieval scope, enabled state and presentation settings.
      </span>
    </summary>

    <div className="catalogue-content">
      Change the tenant's Service Desk Agent, retrieval scope, enabled state and presentation settings.

      | Property     | Value                                                                                        |
      | ------------ | -------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                              |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)  |
      | Custom role  | Yes                                                                                          |
      | Also implies | [tenant.service\_desk.read](/docs/reference/roles-permissions/tenant#tenantservice_deskread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.translation.read [#tenanttranslationread]

      <span className="catalogue-description">
        Read the tenant's translated interface text.
      </span>
    </summary>

    <div className="catalogue-content">
      Read the tenant's translated interface text.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.translation.update [#tenanttranslationupdate]

      <span className="catalogue-description">
        Create or replace tenant translation overrides.
      </span>
    </summary>

    <div className="catalogue-content">
      Create or replace tenant translation overrides.

      | Property    | Value                                                                                       |
      | ----------- | ------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                             |
      | Granted by  | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role | Yes                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### tenant.update [#tenantupdate]

      <span className="catalogue-description">
        Update the selected tenant's general configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Update the selected tenant's general configuration.

      | Property     | Value                                                                                       |
      | ------------ | ------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                             |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator) |
      | Custom role  | Yes                                                                                         |
      | Also implies | [tenant.read](/docs/reference/roles-permissions/tenant#tenantread)                          |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)