Roles & Permissions
Roles control what a user can do in the GPCN™ portal. When you assign a role to a user, you're granting them a defined set of capabilities, and every user must hold at least one role.
Available Roles
GPCN™ provides four roles for most customer organizations:
| Role | Best for |
|---|---|
| Tenant Administrator | Team leads or IT administrators who need full control over infrastructure, users, resource groups, and organization settings |
| Tenant Manager | Administrators who manage resource groups and their membership, with full control over infrastructure in the groups they can reach |
| Tenant Operator | Engineers who manage infrastructure day-to-day within the resource groups they belong to, with read-only access to resource groups and users |
| Tenant Viewer | Team members who need read-only visibility into resources, and who can manage their own profile and credentials |
Tenant Manager was previously called Tenant Power User, and Tenant Viewer was previously called Tenant User — the same roles, renamed. Tenant Operator is new. Reseller and channel accounts also have a Partner role, and your organization can define custom roles holding any combination of permissions, so the four above are the common case rather than the only possibility.
Organization-Wide Roles vs. Resource-Group-Scoped Roles
A role can be assigned two ways:
- Organization-wide — applies across your whole organization. Tenant Administrator and Tenant Manager can only ever be assigned this way.
- Resource-group-scoped — applies only within one resource group, and only for as long as the person stays a member of it. Tenant Operator and Tenant Viewer (and any custom role within that ceiling) can be assigned either way.
An organization-wide role only acts on resources in your organization's Default resource group. To act on resources in any other group, you need a role scoped to that specific group. A Tenant Administrator who wants to manage VMs living in a group called "Production" needs a role scoped to Production, the same as anyone else; being Tenant Administrator doesn't reach into named groups on its own.
Creating, updating or deleting users, and assigning or revoking organization-wide roles, always requires the organization-wide Tenant Administrator role. Managing resource groups themselves — creating, renaming, deleting, or changing membership — requires an organization-wide Tenant Administrator or Tenant Manager role. A role scoped to a resource group never grants either set of capabilities, no matter which role it is.
See Manage Resource Groups for how group membership and roles work together.
What Each Role Can Do
| Capability | Tenant Administrator | Tenant Manager | Tenant Operator | Tenant Viewer |
|---|---|---|---|---|
| Virtual Machines, GPU & Storage | ||||
| View VMs, GPU machines, and volumes | ✓ | ✓ | ✓ | ✓ |
| Create, manage, and delete VMs, GPU machines, and volumes | ✓ | ✓ | ✓ | — |
| Start, stop, restart, and access the console | ✓ | ✓ | ✓ | — |
| Networking | ||||
| View networks, VPCs, and L2 segments | ✓ | ✓ | ✓ | ✓ |
| Create, manage, and delete networks, VPCs, and L2 segments | ✓ | ✓ | ✓ | — |
| Images & Media | ||||
| View custom images | ✓ | ✓ | ✓ | ✓ |
| Upload, edit, and delete custom images | ✓ | ✓ | ✓ | — |
| Resource Groups | ||||
| View resource groups | ✓ | ✓ | ✓ | ✓ |
| Create, rename, delete, and manage membership | ✓ | ✓ | — | — |
| Users & Roles | ||||
| View users and role assignments | ✓ | ✓ | ✓ | ✓ |
| Invite, edit, and delete users | ✓ | — | — | — |
| Assign and revoke organization-wide roles | ✓ | — | — | — |
| Assign and revoke resource-group-scoped Tenant Operator or Tenant Viewer roles | ✓ | ✓ | — | — |
| Single Sign-On | ||||
| Manage SSO providers | ✓ | — | — | — |
| Organization Settings | ||||
| View organization details and contacts | ✓ | ✓ | ✓ | ✓ |
| Edit organization details, contacts, and addresses | ✓ | — | — | — |
| Profile, API Keys & SSH Keys | ||||
| Manage own profile and API keys | ✓ | ✓ | ✓ | ✓ |
| Manage other users' API keys | ✓ | — | — | — |
| Create, manage, and delete SSH keys | ✓ | ✓ | ✓ | — |
| Activity | ||||
| View your own activity | ✓ | ✓ | ✓ | ✓ |
| View the organization's activity | ✓ | ✓ | ✓ | — |
Some of these also depend on a feature being enabled for your organization, not just on your role — GPU and VPC networking both work that way. See Features. L2 segments aren't feature-gated.
Assigning Roles
Organization-wide roles are assigned when inviting a user, or from a user's detail page at any time — this is a Tenant Administrator capability. Resource-group-scoped Tenant Operator and Tenant Viewer roles are assigned from a resource group's Members tab, or from the resource-group section of a user's own detail page — either a Tenant Administrator or a Tenant Manager can do this.
You can only assign roles at or below your own level, so the roles you aren't allowed to grant are hidden from the picker rather than offered and refused.
See Manage Users and Manage Resource Groups for step-by-step instructions.
Next Steps
- Manage Users — invite users and assign organization-wide roles
- Manage Resource Groups — organize users and resources into resource groups
- User Endpoints → — manage users and role assignments via API
.png)