Skip to main content
Noxus authorization is permission-driven and split between:
  • Workspace-level permissions — govern what a user can do inside a specific workspace.
  • Organization-level permissions — control cross-workspace and tenant-wide administration.

Workspace-Level Permissions

A user’s workspace role determines their permissions in that workspace.

workspace_admin cascade behavior

workspace_admin is a superset of the other administration permissions. When a user or API key has workspace_admin, the authorization layer grants:
  • Full integrations access (create, read, edit, delete) — equivalent to integrations_edit plus create/delete.
  • Full workspace users access (create, read, edit, delete) — equivalent to users_edit plus users_delete plus create.
integrations_edit alone grants read and edit on integrations. users_edit alone grants read and edit on workspace members. users_delete alone grants delete on workspace members.

Organization-Level Permissions

These permissions control tenant-wide operations and are checked independently of workspace membership.

Role Scope

Workspace roles can be global or workspace-scoped:
  • Global role — applies to every workspace the user belongs to.
  • Workspace-scoped role — applies only to the specific workspace the role was created for.
Global roles are created from the Roles → Workspace → All workspaces view. Workspace-scoped roles are created for a specific workspace.

Admin Configuration

Role-to-permission mapping and global authorization policy should be managed from Settings → Roles by users with workspace_admin (for workspace roles) or org_admin (for organization roles).
Keep role definitions small and composable. Use the individual permission keys as the stable contract rather than building monolithic admin roles.