.. _cloud-up-access-levels:

~~~~~~~~~~~~~
Access Levels
~~~~~~~~~~~~~~

This section is the authoritative reference for portal permissions. Every portal user
is assigned one of four access levels, which determine what the user can see and do
throughout the portal.

######################
The Four Access Levels
######################

The four assignable access levels, in increasing order of privilege, are:

* **View**
* **Manage**
* **Edit**
* **Admin**

The hierarchy is **View < Manage < Edit < Admin**. Each level includes every capability
of the levels below it.

.. note::

	Despite its name, **Edit** outranks **Manage**. **Manage** edits existing
	entities, while **Edit** can additionally create and delete servers and licenses.
	**Admin** is the top level and is the only level with access to the **Admin**
	section.

------

#####################
Capabilities by Level
#####################

.. list-table::
	:header-rows: 1
	:widths: 15 85

	* - Level
	  - Capabilities
	* - **View**
	  - Read-only access across Cloud Servers, Products, Customers, ID Licensing, and
	    Debug logs.
	* - **Manage**
	  - Everything **View** can do, plus: edit existing companies and contacts; create
	    companies and contacts; enable/disable servers; edit server notes;
	    reread/restart servers; edit products and bundles; bulk enable/disable products;
	    remove license checkouts; view and edit meters; download and delete debug logs.
	* - **Edit**
	  - Everything **Manage** can do, plus: create and delete servers; create and delete
	    products and bundles; bulk-delete; create, replace, and delete licenses.
	* - **Admin**
	  - Everything **Edit** can do, plus the entire **Admin** section: user management;
	    ISV settings file upload; failover configuration; audit-log and report-log
	    retention; custom company fields; and Identity & Access configuration (JWT and
	    Azure).

------

#####################
Internal Portal Admin
#####################

There is also an internal **Portal Admin** level used by Reprise; it cannot be assigned
by ISVs.

------

####################
Enforcement
####################

Access control is enforced server-side, through route gates and form-request
authorization. The user interface additionally hides actions that your access level
does not permit, but the server-side checks are authoritative.