Roles and Permissions
Bitaic uses role-based access control so administrators can match product, CLI, API, and audit access to each user's responsibilities. Assign the narrowest role or permission set that lets the user complete their work.
Default Roles
New workspace access should be assigned explicitly by a workspace creator or Admin. Use default roles first; add API-access scopes only for service tokens or automation that needs them.
| Role | Typical access | CLI/API use |
|---|---|---|
| Viewer | Read-only dashboard, status, and monitoring data access. | Read status, metrics, check results, and profile context. |
| Operator | Monitoring configuration, agent operations, checks, alert workflows, and troubleshooting. | Install or manage agents, configure monitoring targets and checks, and run operational CLI commands. |
| Admin | Workspace administration, user management, roles, integrations, tokens, audit access, and security settings. | Manage service tokens, webhooks, integrations, user or role administration, and audit-log export. |
CLI And Automation Permissions
| Task | Recommended permission | Notes |
|---|---|---|
| Read status and metrics | Viewer | Works for dashboards, read-only CLI status commands, and reporting automations. |
| Manage monitoring targets, agents, checks, and alerts | Operator | Use for day-to-day product operations and incident triage without granting user-administration rights. |
| Manage service tokens, integrations, webhooks, users, and roles | Admin or API-access permission | Use separate least-privilege tokens for automation that only needs API, webhook, or integration access. |
Assigning Roles
Assign roles in the Bitaic App under Settings > User Management. Review role assignments whenever a team member changes responsibility, a service token owner changes, or an integration gains new permissions.
Local Host Permissions
Bitaic workspace roles do not replace local host authorization. Agent installation, service management, host metric collection, and Windows event log access still require the corresponding operating-system permissions on the host where the CLI or agent runs.
Best Practices
- Use the principle of least privilege for users, profiles, and service tokens.
- Keep CLI credentials out of committed scripts, repositories, and shared configuration files.
- Rotate service tokens when owners change or when a secret may have been exposed.
- Review audit logs after role, token, webhook, and integration changes.