infisical/docs/internals/permissions/organization-permissions.mdx

---
title: "Organization Permissions"
description: "Comprehensive guide to Infisical's organization-level permissions"
---

## Overview

Infisical's organization permissions system follows a role-based access control (RBAC) model built on a subject-action-object framework. At the organization level, these permissions determine what actions users/machines can perform on various resources across the entire organization.

Each permission consists of:

- **Subject**: The resource the permission applies to (e.g., workspaces, members, billing)
- **Action**: The operation that can be performed (e.g., read, create, edit, delete)

Some organization-level resources—specifically `app-connections`—support conditional permissions and permission inversion for more granular access control.

## Available Organization Permissions

Below is a comprehensive list of all available organization-level subjects and their supported actions, organized by functional area.

### Workspace Management

#### Subject: `workspace`

| Action   | Description           |
| -------- | --------------------- |
| `create` | Create new workspaces |

### Role Management

#### Subject: `role`

| Action   | Description                                            |
| -------- | ------------------------------------------------------ |
| `read`   | View organization roles and their assigned permissions |
| `create` | Create new organization roles                          |
| `edit`   | Modify existing organization roles                     |
| `delete` | Remove organization roles                              |

### User Management

#### Subject: `member`

| Action   | Description                          |
| -------- | ------------------------------------ |
| `read`   | View organization members            |
| `create` | Add new members to the organization  |
| `edit`   | Modify member details                |
| `delete` | Remove members from the organization |

#### Subject: `groups`

| Action             | Description                                      |
| ------------------ | ------------------------------------------------ |
| `read`             | View organization groups                         |
| `create`           | Create new groups in the organization            |
| `edit`             | Modify existing groups                           |
| `delete`           | Remove groups from the organization              |
| `grant-privileges` | Change permission levels for organization groups |
| `add-members`      | Add members to groups                            |
| `remove-members`   | Remove members from groups                       |

#### Subject: `identity`

| Action             | Description                                         |
| ------------------ | --------------------------------------------------- |
| `read`             | View organization identities                        |
| `create`           | Add new identities to organization                  |
| `edit`             | Modify organization identities                      |
| `delete`           | Remove identities from organization                 |
| `grant-privileges` | Change permission levels of organization identities |
| `revoke-auth`      | Revoke authentication for identities                |
| `create-token`     | Create new authentication tokens                    |
| `delete-token`     | Delete authentication tokens                        |
| `get-token`        | Retrieve authentication tokens                      |

### Security & Compliance

#### Subject: `secret-scanning`

| Action   | Description                               |
| -------- | ----------------------------------------- |
| `read`   | View secret scanning results and settings |
| `create` | Configure secret scanning                 |
| `edit`   | Modify secret scanning settings           |
| `delete` | Remove secret scanning configuration      |

#### Subject: `settings`

| Action   | Description                               |
| -------- | ----------------------------------------- |
| `read`   | View organization settings                |
| `create` | Setup and configure organization settings |
| `edit`   | Modify organization settings              |
| `delete` | Remove organization settings              |

#### Subject: `incident-contact`

| Action   | Description                      |
| -------- | -------------------------------- |
| `read`   | View incident contacts           |
| `create` | Set up new incident contacts     |
| `edit`   | Modify incident contact settings |
| `delete` | Remove incident contacts         |

#### Subject: `audit-logs`

| Action | Description                  |
| ------ | ---------------------------- |
| `read` | View organization audit logs |

### Identity Provider Integration

#### Subject: `sso`

| Action   | Description                        |
| -------- | ---------------------------------- |
| `read`   | View Single Sign-On configurations |
| `create` | Set up new SSO integrations        |
| `edit`   | Modify existing SSO settings       |
| `delete` | Remove SSO configurations          |

#### Subject: `scim`

| Action   | Description                   |
| -------- | ----------------------------- |
| `read`   | View SCIM configurations      |
| `create` | Set up new SCIM provisioning  |
| `edit`   | Modify existing SCIM settings |
| `delete` | Remove SCIM configurations    |

#### Subject: `ldap`

| Action   | Description                   |
| -------- | ----------------------------- |
| `read`   | View LDAP configurations      |
| `create` | Set up new LDAP integrations  |
| `edit`   | Modify existing LDAP settings |
| `delete` | Remove LDAP configurations    |

### Billing & Subscriptions

#### Subject: `billing`

| Action           | Description                                      |
| ---------------- | ------------------------------------------------ |
| `read`           | View billing information and subscription status |
| `manage-billing` | Manage billing details and subscription plans    |

### Templates & Automation

#### Subject: `project-templates`

| Action   | Description                       |
| -------- | --------------------------------- |
| `read`   | View project templates            |
| `create` | Create new project templates      |
| `edit`   | Modify existing project templates |
| `delete` | Remove project templates          |

### Integrations

#### Subject: `app-connections`

Supports conditions and permission inversion

| Action    | Description                        |
| --------- | ---------------------------------- |
| `read`    | View app connection configurations |
| `create`  | Create new app connections         |
| `edit`    | Modify existing app connections    |
| `delete`  | Remove app connections             |
| `connect` | Use app connections                |

### Key Management

#### Subject: `kms`

| Action   | Description                          |
| -------- | ------------------------------------ |
| `read`   | View organization KMS configurations |
| `create` | Set up new KMS configurations        |
| `edit`   | Modify KMS settings                  |
| `delete` | Remove KMS configurations            |

#### Subject: `kmip`

| Action  | Description                        |
| ------- | ---------------------------------- |
| `setup` | Configure KMIP server settings     |
| `proxy` | Act as a proxy for KMIP operations |

### Admin Tools

#### Subject: `organization-admin-console`

| Action                | Description                                 |
| --------------------- | ------------------------------------------- |
| `access-all-projects` | Access all projects within the organization |

### Secure Share

#### Subject: `secret-share`

| Action            | Description                  |
| ----------------- | ---------------------------- |
| `manage-settings` | Manage secret share settings |

### Gateway Management

#### Subject: `gateway`

| Action            | Description                       |
| ----------------- | --------------------------------- |
| `list-gateways`   | View all organization gateways    |
| `create-gateways` | Add new gateways to organization  |
| `edit-gateways`   | Modify existing gateway settings  |
| `delete-gateways` | Remove gateways from organization |
| `attach-gateways` | Attach gateways to resources      |