Managing user permissions
The SC//Reliant™ platform offers a range of permission levels to ensure that each team member has the right access to perform their tasks efficiently. This document provides details about the roles and the permissions available to each user.
In addition to capability-based permissions, SC//Reliant Platform Manager also supports property-scoped permissions, which independently control which specific node and node group properties a role is allowed to edit. See the Property-scoped permissions section at the end of this document for details.
Least-privilege access
Permissions in the SC//Reliant platform are designed around the principle of least privilege: each role grants the smallest set of capabilities required to perform a documented job function, and no more. Access is granted based on job role and business need with management approval, and is intended to be reviewed on a regular cadence (for example, quarterly) and at every role change or termination event.
Two access-control mechanisms operate together to enforce least privilege:
- Capabilities. Discrete permissions that gate specific actions (for example, Create a node, Delete a firewall policy, Manage roles for other users). Capabilities are grouped by resource type and by the section of the SC//Reliant Platform Manager console they affect, so a role can be built around the resources a job function actually needs to touch.
- Property-scoped permissions. A separate scoping layer that restricts which node and node-group properties a role can edit, independently of the capabilities granted. This allows a role to hold a write capability (for example, Update a node) while being limited to a specific subset of properties on that node.
Together, capabilities and property scoping support separation of duties, for example, a role that can administer firewall and Internet Content Control policies without being able to manage payment devices, or a role that can update network properties on nodes without being able to change store-level configuration. All administrative actions are tied to the unique user account that performed them.
Why proper user management matters
Effective user management is crucial for maintaining security and productivity within your organization. By assigning appropriate permission levels, you can:
- Enhance Security: Ensure that only authorized personnel have access to sensitive information and critical functions.
- Boost Efficiency: Allow users to perform their roles without unnecessary restrictions or access to unrelated features.
- Stay Compliant: Maintain control over who can view and modify data, ensuring compliance with internal policies and external regulations.
SC//Reliant platform capabilities
The following tables detail the available user permissions (also referred to as capabilities). They are broken down by the resource type and the sections of the SC//Reliant Platform Manager console they affect.
Inventory
| Resource | Capability | Description |
|---|---|---|
| Nodes | List nodes | Grants the ability to view the hostnames for all nodes. |
| View node details | Grants the ability to view the configurable node properties. | |
| Create a node | Grants the ability to create a new node. | |
| Update a node | Grants the ability to update a node. For example, to update the network interface details for a node. | |
| Update a node serial number | Grants the ability to add or change the serial number for a node. | |
| Delete a node | Grants the ability to delete a node. This deletes all configuration details and files in SC//Reliant Platform Manager for the node. | |
| List virtual nodes | Grants the ability to see a list of virtual nodes hosted on a node. | |
| View virtual node details | Grants the ability to see the details of a virtual node hosted on a node. | |
| Delete a virtual node | Grants the ability to delete a virtual node. | |
| Characterize a node | Grants the ability to characterize a node. | |
| Create a virtual node | Grants the ability to create a virtual node on a node. | |
| Update a virtual node | Grants the ability to update the details of a virtual node. | |
| Node installation monitoring | Generate Batch QR codes | Grants the ability to generate a QR code for a node, specified by the node number. The QR code links to the Edge Status Monitor which provides the installation status for the node. |
| Manage tokens | Grants the ability to generate a new token and enable/disable existing tokens. These tokens are used to access the Edge Status Monitor. The default expiration time for the token is 3 hours. This is viewable at the node level on the SC//Reliant Platform Manager using the Edge Install Monitoring field. | |
| Saved filters (Located under Services in SC//Reliant Platform Manager, but relate to querying your nodes.) | List saved filters | Grants the ability to list saved filters. |
| Create and update a saved filter | Grants the ability to create a new saved filter and update an existing saved filter. Saved filters are used to store query filters on your node list you regularly use for quick access. | |
| Delete a saved filter | Grants the ability to delete a saved filter. | |
| Servers | List servers | Grants the ability to list the servers that are located in each server group. |
| View server details | Grants the ability to view the server details for each server host. | |
| Create and update a server | Grants the ability to create a new server and update an existing server. | |
| Update a server serial number | Grants the ability to add or change the serial number for a server. | |
| Characterize a server | Grants the ability to characterize a server. | |
| Delete a server | Grants the ability to delete a server. | |
| Node Groups | List node groups | Grants the ability to list node groups. |
| View node group details | Grants the ability to view the node group details. | |
| Create a node group | Grants the ability to create a node group. | |
| Clone a node group | Grants the ability to clone an existing node group. | |
| Update a node group | Grants the ability to update an existing node group. | |
| Characterize a node group | Grants the ability to specify the node group type. This is done using the Type of Server property, which is used in the management of servers specific to payment environments who use LoH. This field doesn't impact actual implementation. |
|
| Edit the template name of a node group | Grants the ability to identify the name of the template used by the node group. | |
| Delete a node group | Grants the ability to delete a node group. | |
| Node Import | List previous node imports | Grants the ability to list previous imports of nodes from CSV files. |
| Import nodes from a CSV file | Grants the ability to import nodes from a CSV file. | |
| Server Import | List previous server imports | Grants the ability to list previous imports of servers from CSV files. |
| Import servers from a CSV file | Grants the ability to import servers from a CSV file. |
Job management
| Resource | Capability | Description |
|---|---|---|
| Job management | List ETL Imports | Grants the ability to list ETL Imports. The ETL import feature is used to set up integration with ACI Asset Manager. |
| Download ETL files | Grants the ability to download the original and processed ETL files from SC//Reliant Platform Manager. | |
| List exporter jobs | Grants the ability to list exporter jobs. An exporter job is a backend process that performs a database update when a data change occurs that affects a node, node group, server, or site. An exporter job is usually started automatically when a data change occurs. | |
| Create and update an exporter job | Grants the ability to manually trigger an exporter job in SC//Reliant Platform Manager. This is done using the Trigger Exporters button on the exporters job list. | |
| List remote job executions | Grants the ability to list remote job executions for a tenant. | |
| View details about a remote job execution | Grants the ability to view details about a remote job execution. This includes the job type, status, which user started the job, what time it started and finished, and any messages associated with the job. | |
| Create and update a Puppet run job | Grants the ability to create a new Puppet run job or update an existing Puppet run job. | |
| Create and update a SC//Reliant Virtual Controller (RVC) job | Grants the ability to create a new RVC job or update an existing RVC job. | |
| Create and update a service check job | Grants the ability to create a new service check job or update an existing service check job. | |
| RVC endpoint | Call Cluster read-only methods | Grants the ability to call the cluster.enabled?, cluster.info, cluster.ping, and cluster.status RVC modules using the RVC Jobs v2 API endpoint. |
| Call Cluster state altering methods | Grants the ability to call the cluster.enable-maintenance-mode, cluster.disable-maintenance-mode, and cluster.maintenance-mode? RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call Docker read-only methods | Grants the ability to call the docker.images, docker.containers, docker.stats, and docker.report RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call Docker state altering methods | Currently this permission doesn't grant any additional capabilities. | |
| Call KVM read-only methods | Grants the ability to call the kvm.list, kvm.info, kvm.status, kvm.screenshot, and kvm.snapshot_list RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call KVM state altering methods | Grants the ability to call the kvm.start, kvm.reboot, kvm.shutdown, kvm.snapshot, kvm.snapshot-consolidate, kvm.snapshot-restore, kvm.snapshot-sync, kvm.snapshot-redefine, kvm.full-backup, and kvm.restore RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call System read-only methods | Grants the ability to call the sys.crontab, sys.hardware, sys.memory, sys.network, sys.os, sys.process, sys.storage, sys.time, and sys.timezone RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call System state altering methods | Currently this permission doesn't grant any additional capabilities. | |
| Call Shell read-only methods | Grants the ability to call the shell.list_processes and shell.process_status RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call Shell state altering methods | Grants the ability to call the shell.execute, shell.execute-async, and shell.send-signal RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call RVC read-only methods | Grants the ability to call the rvc.api, rvc.busy, rvc.diagnostics, rvc.external_connectivity_check, rvc.instance, rvc.state, and rvc.version RVC modules using the RVC Jobs v2 API endpoint. |
|
| Call RVC state altering methods | Grants the ability to call the rvc.subscribe and rvc.unsubscribe RVC modules using the RVC Jobs v2 API endpoint. |
|
| Ownership transfer | Create and update an Ownership Transfer | Grants the ability to perform an Ownership Transfer or update an existing Ownership Transfer. |
| List Ownership Transfers | Grants the ability to list the Ownership Transfers for a tenant. This permission is also required to make the Ownership Transfer option visible in SC//Reliant Platform Manager. | |
| View details about an Ownership Transfer | Grants the ability to view details about an Ownership Transfer. |
Services
| Resource | Capability | Description |
|---|---|---|
| Firewall policies | List firewall policies | Grants the ability to list the firewall policies. |
| View firewall policy details | Grants the ability to see the specific firewall rules for each policy. | |
| Create and update a firewall policy | Grants the ability to create a firewall policy and update specific firewall rules within the policy. | |
| Clone a firewall policy | Grants the ability to clone an existing firewall policy. | |
| Delete a firewall policy | Grants the ability to delete a firewall policy. | |
| Firewall rules | List firewall rules | Grants the ability to see the list of firewall rules for a firewall policy. |
| View firewall rule details | Grants the ability to see details of a firewall rule, for example, the source IP address, destination IP address, and port number for a rule. | |
| Create and update a firewall rule | Grants the ability to create a firewall rule and update the details of an existing firewall rule. | |
| Clone a firewall rule | Grants the ability to clone an existing firewall rule. | |
| Delete a firewall rule | Grants the ability to delete a firewall rule. | |
| Internet Content Control (ICC) | List ICC policies | Grants the ability to list ICC policies. |
| View ICC policy details | Grants the ability to view the details of an ICC policy. | |
| Create and update an ICC policy | Grants the ability to create or update an ICC policy. | |
| Delete an ICC policy | Grants the ability to delete an existing ICC policy. | |
| Stores | List stores | Grants the ability to see the list of stores. |
| View details of a store | Grants the ability to see details of a store. | |
| Create a store | Grants the ability to create a new store. | |
| Import stores from a CSV file | Grants the ability to create new stores using an import from a CSV file. | |
| List store imports | Grants the ability to list existing store imports from a CSV file. | |
| Update a store | Grants the ability to update the details, payment configuration, and payment devices for an existing store. | |
| Export store data to CSV | Grants the ability to export a store and its device data into a CSV file. | |
| Update card acceptor identifier field | Grants the ability to update the Card Acceptor Identifier field for a store. |
|
| Update level of hierarchy field | Grants the ability to update the Level of Hierarchy field for a store. |
|
| Delete a store | Grants the ability to delete a store. | |
| Import Node/LoH configuration files | Grants the ability to import Node and Levels of Hierarchy (LoH) configuration files for a store. | |
| Delete Node/LoH configuration files | Grants the ability to delete Node and Levels of Hierarchy (LoH) configuration files for a store. | |
| Import RTS configuration files | Grants the ability to import RTS configuration files for a store. | |
| Delete RTS configuration files | Grants the ability to delete RTS configuration files for a store. | |
| Import Global configuration files | Grants the ability to import Global configuration files for a store. | |
| Delete Global configuration files | Grants the ability to delete Global configuration files for a store. | |
| Location Import | Import locations | Grants the ability to use the import locations feature. |
| List previous location imports | Grants the ability to see previous location import actions. | |
| Locations | List locations | Grants the ability to list the locations for a tenant. |
| View location details | Grants the ability to view details about a location. These details include location information and the node details for the location. | |
| Create and update a location | Grants the ability to create a new location or update an existing location. | |
| Delete a location | Grants the ability to delete a location. | |
| Export locations to CSV | Grants the ability to export information about locations to a CSV file. | |
| Payment devices | List payment devices | Grants the ability to list payment devices. |
| View details about a payment device | Grants the ability to view the details of a payment device. | |
| Create and update a payment device | Grants the ability to create a new payment device or update an existing payment device. | |
| Delete a payment device | Grants the ability to delete a payment device. | |
| Update the Last Inspected Date field | Grants the ability to update the Last Inspected Date field of a payment device. | |
| View payment device status count | Grants the ability to view the count of payment devices by status. | |
| List payment device types | Grants the ability to list the payment device types. | |
| View details about a payment device type | Grants the ability to view the details of a payment device type. | |
| Create and update a payment device type | Grants the ability to create a new payment device type or update an existing payment device type. | |
| Delete a payment device type | Grants the ability to delete a payment device type. | |
| List packages | Grants the ability to list the packages for a tenant. | |
| View details about a package | Grants the ability to view the details of a package. This includes the status, package file details, any payment device filtering applied, stores, and levels of hierarchy associated with the package. | |
| Create and update a package | Grants the ability to create a new package and update an existing package. | |
| Clone a package | Grants the ability to clone a package. This is used to create a new package with the same details as an existing package. | |
| Delete a package | Grants the ability to delete a package. | |
| Payment server configuration | Update a payment server configuration | Grants the ability to update a payment server configuration. |
| Update the Merchant ID field | Grants the ability to update the Merchant ID field of a payment server configuration. |
Site administration
| Resource | Capability | Description |
|---|---|---|
| Levels of Hierarchy (LoH) definitions | List LoH definitions | Grants the ability to list Levels of Hierarchy definitions. |
| View LoH definition details | Grants the ability to view the details of a Levels of Hierarchy definition. | |
| Create and update an LoH definition | Grants the ability to create a new Levels of Hierarchy definition and update an existing one. | |
| Delete an LoH definition | Grants the ability to delete a Levels of Hierarchy definition. | |
| Levels of Hierarchy (LoH) fields | List LoH fields | Grants the ability to list Levels of Hierarchy fields. |
| Create and update an LoH field | Grants the ability to create a new Levels of Hierarchy field and update an existing one. | |
| Delete an LoH field | Grants the ability to delete a Levels of Hierarchy field. | |
| Cascade delete an LoH field's children | Grants the ability to delete the children of a Levels of Hierarchy field along with the field, if the children are not being used. | |
| Levels of Hierarchy (LoH) import | List previous LoH imports | Grants the ability to list previous imports of Levels of Hierarchy from CSV files. |
| Import LoH from a CSV file | Grants the ability to import Levels of Hierarchy from a CSV file. | |
| Audit trail | List audit trail entries | Grants the ability to list audit trail entries. |
Administration
| Resource | Capability | Description |
|---|---|---|
| User management | List users | Grants the ability to list the users for a tenant. |
| View details about a user | Grants the ability to view details about a user. These details include status, role, email address, and authentication details. | |
| Create a user | Grants the ability to create a new user. | |
| Update a user | Grants the ability to update the details of an existing user. | |
| Manage roles for other users | Grants the ability to update the role associated with a user. | |
| Manage API access for other users | Grants the ability to toggle API access on or off for a user. | |
| View API keys for other users | Grants the ability to view the API keys of other users. | |
| Export users to CSV | Grants the ability to export information about users to a CSV file. | |
| Manage SC//Reliant Platform Manager access for other users | Grants the ability to toggle SC//Reliant Platform Manager console access on or off for a user. | |
| Manage shell access for other users | Grants the ability to toggle shell access on or off for a user. | |
| Lock a user account | Grants the ability to lock a user account. | |
| Unlock a user account | Grants the ability to unlock a user account. | |
| Delete a user | Grants the ability to delete a user. | |
| User shell account management | List shell accounts for a user | Grants the ability to list the shell users for a user account. |
| View details about a shell account for a user | Grants the ability to view details about a shell user for a user account. This includes the home directory for the shell account, whether it has sudo permissions, which groups the shell account has access to, and details about the public key for the user. |
|
| Create and update a shell account for a user | Grants the ability to create a new shell user and update an existing shell user for a user account. | |
| List the SSH keys associated with a user | Grants the ability to list the SSH keys associated with the shell account of a user. | |
| View details about an SSH key for a user | Grants the ability to view details about an SSH key associated with the shell account of a user. | |
| Create and update an SSH key for a user | Grants the ability to create a new SSH key or update an existing SSH key associated with the shell account of a user. | |
| Delete an SSH key for a user | Grants the ability to delete an SSH key associated with the shell account of a user. | |
| Cluster settings | Create and update cluster settings | Grants the ability to create and update cluster settings. |
| Puppet profiles | Assign Puppet profiles to resources | Grants the ability to assign Puppet profiles to resources, such as nodes and node groups. |
Property-scoped permissions
Property-scoped permissions are a separate access-control mechanism from the capabilities described above. They determine which specific node and node group properties a role is allowed to edit, independently of the capabilities granted to the role.
By default, a role has unrestricted property edit access: when no individual properties are selected for the role, users assigned to that role can edit any property on a node or a node group. When one or more properties are selected, the role can edit only those properties, and every other property is read-only for users assigned to that role.
Each editable property is scoped independently for nodes and node groups. A role can be granted edit access to a given property on individual nodes, on node groups, both, or neither.
Scale Computing sets property-scoped permissions when it creates or changes a role. To find out which properties a role can edit, or to request a change, contact your Scale Computing Account Manager.