> This page is for Self-Hosted, version v3.0 (default).
> For other versions, use one of these documentation indexes:
> - v3.0 (default): https://docs.nvidia.com/run-ai/self-hosted/v3.0/llms.txt
> - v2.26: https://docs.nvidia.com/run-ai/self-hosted/v2.26/llms.txt
> - v2.25: https://docs.nvidia.com/run-ai/self-hosted/v2.25/llms.txt
> - v2.24: https://docs.nvidia.com/run-ai/self-hosted/v2.24/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/run-ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/run-ai/_mcp/server.

# Permissions

This page provides a reference of the permissions available in the NVIDIA Run:ai platform. Use it when building [custom roles](/run-ai/self-hosted/documentation/platform-management/authentication/roles) to understand what each permission controls and how permission names in the API map to the names shown in the user interface.

## About Permissions

A permission is the actions (View, Edit, Create and Delete) that the user can perform over a NVIDIA Run:ai entity (resource type). These actions map to the API actions `read`, `update`, `create`, and `delete` respectively. Related permissions are grouped into [permission sets](#permission-sets), and a [role](/run-ai/self-hosted/documentation/platform-management/authentication/roles) is defined as a collection of permission sets assigned to a subject in a scope. NVIDIA Run:ai provides predefined roles that are system-defined and cannot be edited or deleted. Administrators can also create custom roles via the API.

When you build a custom role through the API, permissions are referenced by their **API name** (for example, `compute-resources`). The NVIDIA Run:ai user interface presents the same permission under a **display name** (for example, "Compute resources"). The tables below map the two and describe what each permission controls.

<Note>

**Note**

* Some permissions are system-internal and are not shown in the Roles view in the user interface. These are noted in the tables below.
* **Deprecated:** The `apps` API name is deprecated. Use `service-account` for managing service accounts.

</Note>

## Permission Reference

The following table lists all permissions, mapping each permission's API name to its user interface display name and describing what it controls.

| API name | Display name | Description |
| --- | --- | --- |
| `access-keys` | [Access Keys](/run-ai/self-hosted/documentation/platform-management/settings/user-settings/user-access-keys) | Access keys are used for API integrations with NVIDIA Run:ai. An access key contains a client ID and a client secret. This permission is not shown in the Roles view. |
| `access_rules` | [Access rules](/run-ai/self-hosted/documentation/platform-management/authentication/access-rules) | Access rules provide users, groups, or service accounts privileges to system entities. An access rule is the assignment of a role to a subject in a scope. |
| `tenant` | Account | The top-level organizational node headed by the account, comprised of clusters, departments, and projects. |
| `applications` | [AI Applications](/run-ai/self-hosted/documentation/ai-applications/submit-ai-applications) | An AI application represents a high-level logical grouping of all Kubernetes resources that together deliver a functional AI solution. |
| `apps` | [Applications](/run-ai/self-hosted/documentation/platform-management/authentication/service-accounts) | Deprecated. Superseded by `service-account`. Distinct from `applications` (AI Applications). |
| `branding-settings` | [Branding settings](/run-ai/self-hosted/documentation/platform-management/settings/general-settings#branding) | Custom logo displayed in the top-right corner of the NVIDIA Run:ai platform interface. |
| `cluster-config` | [Advanced cluster configuration](/run-ai/self-hosted/documentation/installation-and-configuration/config/advanced-cluster-configuration) | Governs synchronization of cluster configuration between a cluster and the control plane. This permission is system-internal: it is not shown in the Roles view and is not held by tenant administrators. Do not include `cluster-config` in a custom role. A role that includes it cannot be assigned, and access rule creation fails with `403 Insufficient permissions`. |
| `cluster` | [Clusters](/run-ai/self-hosted/documentation/installation-and-configuration/operate/clusters) | A registered Kubernetes cluster that the NVIDIA Run:ai control plane manages, schedules workloads on, and monitors. |
| `clusters-minimal` | [Clusters minimal](/run-ai/self-hosted/documentation/installation-and-configuration/operate/clusters) | Provides read-only access to a lightweight subset of cluster metadata (name, ID, status). Automatically included by the platform when a role grants cluster read access, to support resource display in the user interface. |
| `compute-resources` | [Compute resources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/compute-resources) | A compute resource is a workload asset template that simplifies how workloads are submitted and can be used by AI practitioners when they submit their workloads. |
| `credentials` | [Credentials](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/credentials) | Credentials are workload assets that mask sensitive access information, such as passwords, tokens, and access keys, necessary for accessing protected resources. |
| `pvc-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/data-volumes) | A data source asset backed by a Persistent Volume Claim (PVC), a Kubernetes concept for managing cluster storage provisioned by an administrator or dynamically using a StorageClass. |
| `git-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/overview) | A data source asset that copies code from a Git branch into a dedicated folder in the container, providing the workload with the latest code repository. |
| `nfs-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/overview) | A data source asset backed by a Network File System (NFS), used for sharing storage among pods in the cluster; content is preserved outside the lifecycle of a single pod. |
| `s3-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/overview) | A data source asset that maps a remote S3 bucket into the workload's file system, accessible across different workload executions. |
| `host-path-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/overview) | A data source asset that mounts a host path file or directory on the workload's file system; data persists across workloads. |
| `cm-volume-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/overview) | A data source asset backed by a Kubernetes ConfigMap, used to store non-confidential data such as environment variables and command-line arguments. |
| `secret-volume-assets` | [Data sources](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/overview) | A data source asset that maps a credential into the workload's file system to provide sensitive access information such as passwords, tokens, and access keys. |
| `datavolumes` | [Data volumes](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/data-volumes) | Data volumes are workload assets that offer a solution for storing, managing, and sharing AI training data across scopes and workloads. |
| `department` | [Departments](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/organization/departments) | Departments group multiple projects under a shared organizational scope for quota management, policy enforcement, and asset sharing. |
| `environments` | [Environments](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/environments) | An environment is a workload asset consisting of a configuration that simplifies how workloads are submitted and can be used by AI practitioners. |
| `events-history` | [Event history](/run-ai/self-hosted/documentation/installation-and-configuration/operate/observability/event-history) | An audit log of all changes to business objects (clusters, projects, assets, and more) in the NVIDIA Run:ai platform, accessible to system administrators with tenant-wide permissions. |
| `inferences` | [Inferences](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/using-inference/custom-inference) | Inference workloads deploy trained models to make real-time or batch predictions in a production environment. |
| `network-topologies` | [Network topologies](/run-ai/self-hosted/documentation/installation-and-configuration/operate/clusters) | Named configurations of node labels that describe the physical network structure of a cluster (racks, blocks, NVLink domains), used by the scheduler to minimize latency for distributed workloads. |
| `nodepools` | [Node pools](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/resources/node-pools) | A node pool is a NVIDIA Run:ai construct representing a set of nodes grouped into a bucket of resources using a predefined or administrator-defined node label. |
| `nodepools-minimal` | [Node pools minimal](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/resources/node-pools) | Provides read-only access to a lightweight subset of node pool metadata. Automatically included by the platform when a role grants node pool, department, or project read access. |
| `nodes` | [Nodes](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/resources/nodes) | Nodes are Kubernetes elements automatically discovered by the NVIDIA Run:ai platform and registered for scheduling and administrator visibility. |
| `notification-settings` | [Notification settings](/run-ai/self-hosted/documentation/platform-management/settings/general-settings/notifications) | Configuration for notification options that keep administrators and users informed of important events and updates. |
| `policies` | [Policies](/run-ai/self-hosted/documentation/platform-management/policies/native-workload-policies) | Workload policies allow administrators to set best practices, enforce limitations, and standardize workload submission processes within their organization. |
| `project` | [Projects](/run-ai/self-hosted/documentation/platform-management/manage-ai-initiatives/organization/projects) | Projects are the primary organization management unit in NVIDIA Run:ai, used to control how resources are allocated and prioritized across teams and initiatives. |
| `registries` | [Registries](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/assets/environments#adding-a-new-environment) | Stored connection configurations for private container image registries, used when selecting images in environment assets. |
| `roles` | [Roles](/run-ai/self-hosted/documentation/platform-management/authentication/roles) | A role defines a set of permissions that can be assigned to a subject in a scope, determining which actions the subject is allowed to perform on NVIDIA Run:ai entities. |
| `security-settings` | [Security settings](/run-ai/self-hosted/documentation/platform-management/settings/general-settings#security) | Platform-level identity provider (SSO) configuration and session security settings. |
| `service-account` | [Service accounts](/run-ai/self-hosted/documentation/platform-management/authentication/service-accounts) | Service accounts are used for API integrations with NVIDIA Run:ai. A service account contains a client ID and a client secret. |
| `settings` | [Settings](/run-ai/self-hosted/documentation/platform-management/settings/general-settings) | Centralized controls for enabling or disabling key NVIDIA Run:ai platform features across resources, workload types, and security. |
| `storage-class-configuration` | Storage class configuration | Kubernetes storage classes define how storage is provisioned for AI workloads, used when creating PVC data sources and data volumes. |
| `templates` | [Templates](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/workload-templates) | A workload template is a reusable setup that defines all the required configuration fields for submitting a workload, allowing users to predefine settings. |
| `trainings` | [Trainings](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/using-training/train-models) | Training workloads run resource-intensive, batch-mode model development jobs, often requiring distributed computing across multiple nodes. |
| `users` | [Users](/run-ai/self-hosted/documentation/platform-management/authentication/users) | Users can be managed locally or via an identity provider (IdP) and are assigned permissions through access rules. |
| `users-minimal` | [Users minimal](/run-ai/self-hosted/documentation/platform-management/authentication/users) | Provides read-only access to a minimal subset of user data, such as user IDs and display names. Used by system roles to resolve user identities without exposing full user management permissions. |
| `workload-integration-metrics` | Workload integration metrics | System-internal. Used by the platform to collect workload metrics from integrations. Not intended to be assigned when building custom roles. |
| `workload-properties` | [Workload properties](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/workloads#managing-workload-properties) | The priority, preemptibility, and workload category assigned to each workload type by default. |
| `workloads` | [Workloads](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/workloads) | Workloads are the fundamental building blocks for consuming resources, enabling AI practitioners to support the entire lifecycle of an AI initiative. |
| `workspaces` | [Workspaces](/run-ai/self-hosted/documentation/workloads-in-nvidia-run-ai/using-workspaces/running-workspace) | The workspace is where data scientists conduct initial research, experiment with data sets, and test algorithms — the most flexible stage in the ML lifecycle. |

<Note>

**Note**

The seven `*-assets` API names above all appear under the single **Data sources** display name in the user interface. When building a custom role via the API, grant the specific asset types your users need using the relevant permission sets.

</Note>

## Permission Sets

Permissions are bundled into **permission sets** — reusable building blocks that group the actions for a particular functional area (for example, viewing workloads or managing clusters). Permission sets are used through the [Roles](/run-ai/self-hosted/documentation/platform-management/authentication/roles) API to define both predefined and custom roles, and are referenced by the API names below. Most permission sets come in a **read** variant (view only) and an **edit** variant (create, read, update, and delete). The following permission sets are available:

| API name | Description |
| --- | --- |
| `workspaceEditAccess` | Grants full permissions to create, read, update, and delete workspaces, and to access all related data and resources required for their management. |
| `trainingEditAccess` | Grants full permissions to create, read, update, and delete training workloads, and to access all related data and resources required for their management. |
| `inferenceEditAccess` | Grants full permissions to create, read, update, and delete inference workloads, and to access all related data and resources required for their management. |
| `yamlWorkloadEditAccess` | Grants full permissions to create, read, update, and delete workloads defined in YAML, and to access all related data and resources required for their management. |
| `workloadReadAccess` | Grants permissions to view workloads, including all related data and resources associated with them. |
| `workloadPropertiesEditAccess` | Grants full permissions to create, read, update, and delete workload properties, and to access all related data and resources required for their management. |
| `workloadPropertiesReadAccess` | Grants permissions to view workload properties, including all related data and resources associated with them. |
| `templatesEditAccess` | Grants full permissions to create, read, update, and delete workload templates, and to access all related data and resources required for their management. |
| `templatesReadAccess` | Grants permissions to view workload templates, including all related data and resources associated with them. |
| `templatesOnlyEditAccess` | Grants permissions to create, read, update, and delete workload templates. |
| `templatesOnlyReadAccess` | Grants permissions to view workload templates. |
| `environmentsOnlyEditAccess` | Grants permissions to create, read, update, and delete environments. |
| `environmentsOnlyReadAccess` | Grants permissions to view environments. |
| `computeResourcesOnlyEditAccess` | Grants permissions to create, read, update, and delete compute resources. |
| `computeResourcesOnlyReadAccess` | Grants permissions to view compute resources. |
| `credentialsOnlyEditAccess` | Grants permissions to create, read, update, and delete credentials. |
| `credentialsOnlyReadAccess` | Grants permissions to view credentials. |
| `dataAndStorageEditAccess` | Grants full permissions to create, read, update, and delete data and storage, and to access all related data and resources required for their management. |
| `dataAndStorageReadAccess` | Grants permissions to view data and storage, including all related data and resources associated with them. |
| `policiesEditAccess` | Grants full permissions to create, read, update, and delete policies, and to access all related data and resources required for their management. |
| `policiesReadAccess` | Grants permissions to view policies, including all related data and resources associated with them. |
| `projectsEditAccess` | Grants full permissions to create, read, update, and delete projects, and to access all related data and resources required for their management. |
| `projectsReadAccess` | Grants permissions to view projects, including all related data and resources associated with them. |
| `departmentsEditAccess` | Grants full permissions to create, read, update, and delete departments, and to access all related data and resources required for their management. |
| `departmentsReadAccess` | Grants permissions to view departments, including all related data and resources associated with them. |
| `clustersEditAccess` | Grants permissions to create, read, update, and delete clusters. |
| `clustersReadAccess` | Grants permissions to view clusters. |
| `networkTopologyEditAccess` | Grants full permissions to create, read, update, and delete network topologies, and to access all related data and resources required for their management. |
| `networkTopologyReadAccess` | Grants permissions to view network topologies, including all related data and resources associated with them. |
| `nodesReadAccess` | Grants permissions to view nodes, including all related data and resources associated with them. |
| `nodePoolsEditAccess` | Grants full permissions to create, read, update, and delete node pools, and to access all related data and resources required for their management. |
| `nodePoolsReadAccess` | Grants permissions to view node pools, including all related data and resources associated with them. |
| `quotaManagementDashboardReadAccess` | Grants permissions to view the quota management dashboard, including all related data and resources associated with them. |
| `usersEditAccess` | Grants permissions to create, read, update, and delete users. |
| `usersReadAccess` | Grants permissions to view users. |
| `serviceAccountsEditAccess` | Grants permissions to create, read, update, and delete service accounts. |
| `serviceAccountsReadAccess` | Grants permissions to view service accounts. |
| `accessRulesEditAccess` | Grants full permissions to create, read, update, and delete access rules, and to access all related data and resources required for their management. |
| `accessRulesReadAccess` | Grants permissions to view access rules, including all related data and resources associated with them. |
| `rolesEditAccess` | Grants permissions to create, read, update, and delete roles. |
| `rolesReadAccess` | Grants permissions to view roles. |
| `settingsEditAccess` | Grants permissions to create, read, update, and delete settings. |
| `settingsReadAccess` | Grants permissions to view settings. |
| `securitySettingsEditAccess` | Grants permissions to create, read, update, and delete security settings. |
| `securitySettingsReadAccess` | Grants permissions to view security settings. |
| `brandingSettingsEditAccess` | Grants permissions to create, read, update, and delete branding settings. |
| `brandingSettingsReadAccess` | Grants permissions to view branding settings. |
| `eventHistoryReadAccess` | Grants permissions to view event history. |
| `accountEditAccess` | Grants permissions to create, read, update, and delete accounts. |
| `accountReadAccess` | Grants permissions to view accounts. |
| `accessKeysEditAccess` | Grants full permissions to create, read, update, and delete user access keys. |
| `storageClassConfigurationEditAccess` | Grants full permissions to create, read, update, and delete storage class configurations used by volume and PVC assets. |