11.5Appendix: permission reference

Last updated 9 October 2026

This appendix lists every permission by area. The technical name is what roles store and what the REST API checks.

Directory: Active Directory content

Permission	Allows	Risk
`ad:users:list`	See the list of user accounts and search the directory.	View only
`ad:users:read`	Open a user account and view its attributes and group memberships.	View only
`ad:users:create`	Add new user accounts.	Changes data
`ad:users:update`	Change user attributes, reset passwords, enable or disable accounts.	Changes data
`ad:users:delete`	Permanently remove user accounts.	Irreversible
`ad:groups:list`	See and search groups.	View only
`ad:groups:read`	Open a group and view its details and members.	View only
`ad:groups:create`	Create security and distribution groups.	Changes data
`ad:groups:update`	Rename groups and add or remove members.	Changes data
`ad:groups:delete`	Permanently remove groups.	Irreversible
`ad:ous:list`	See the organisational unit tree.	View only
`ad:ous:read`	Open an organisational unit and view its details.	View only
`ad:ous:create`	Create organisational units.	Changes data
`ad:ous:update`	Rename organisational units and change their attributes.	Changes data
`ad:ous:delete`	Remove organisational units and everything they contain.	Irreversible
`ad:computers:list`	See computer accounts.	View only
`ad:computers:read`	Open a computer account.	View only
`ad:computers:create`	Add computer accounts.	Changes data
`ad:computers:update`	Change computer attributes, reset the machine password, enable or disable.	Changes data
`ad:computers:delete`	Permanently remove computer accounts.	Irreversible
`ad:objects:list`	See objects that have no dedicated screen (contacts, printers and others).	View only
`ad:objects:read`	Open any directory object and view its raw attributes.	View only
`ad:objects:create`	Create directory objects of any class.	Changes data
`ad:objects:update`	Change, rename or move any directory object.	Changes data
`ad:objects:delete`	Permanently remove any directory object.	Irreversible
`ad:directory:read`	Browse the directory tree and read the attributes of its entries; also needed to choose a directory in the top bar.	View only

Directory: security, service accounts and policy

Permission	Allows	Risk
`ad:acl:read`	View an object's access control list and its delegations.	View only
`ad:acl:manage`	Add or remove access entries, change the owner, block inheritance.	Security-sensitive
`ad:acl:delegate`	Apply or remove a named delegation template. Templates that confer full control also need `ad:acl:manage`.	Security-sensitive
`ad:spn:manage`	View and change service principal names on an account.	Security-sensitive
`ad:serviceaccounts:list`	See managed service accounts.	View only
`ad:serviceaccounts:read`	Open a service account and view its configuration.	View only
`ad:serviceaccounts:create`	Create managed and group managed service accounts.	Security-sensitive
`ad:serviceaccounts:update`	Change a service account, including which hosts may retrieve its password.	Security-sensitive
`ad:serviceaccounts:delete`	Permanently remove service accounts.	Irreversible
`ad:password-policies:list`	See the default domain policy and fine-grained password policies.	View only
`ad:password-policies:read`	Open a password policy and its subjects.	View only
`ad:password-policies:create`	Create fine-grained password policies.	Changes data
`ad:password-policies:update`	Change password policies, including the default domain policy.	Changes data
`ad:password-policies:delete`	Remove fine-grained password policies.	Irreversible

Directory: Recycle Bin and saved searches

Permission	Allows	Risk
`ad:deleted-objects:list`	See what has been deleted and is still restorable.	View only
`ad:deleted-objects:restore`	Bring a deleted object back with its original identity and access.	Security-sensitive
`ad:deleted-objects:restore-privileged`	Bring back a deleted administrator, with its administrative memberships. Needs `ad:deleted-objects:restore` too.	Irreversible
`ad:deleted-objects:reapply-attributes`	Write a restored object's attributes back from the copy kept before deletion.	Changes data
`savedfilters:list`	See the saved searches available to the team.	View only
`savedfilters:read`	Open a saved search and view its query.	View only
`savedfilters:execute`	Run a saved search and view its results.	View only
`savedfilters:create`	Save new searches for others to reuse.	Changes data
`savedfilters:update`	Change a saved search's name or query.	Changes data
`savedfilters:delete`	Remove saved searches.	Irreversible

Access governance

Permission	Allows	Risk
`users:list`	See who has an account on this platform.	View only
`users:read`	Open a platform account and view its profile and roles.	View only
`users:create`	Create platform accounts.	Security-sensitive
`users:update`	Edit accounts, reset passwords, send setup links, reset two-factor, link Windows accounts, activate and deactivate.	Security-sensitive
`users:delete`	Permanently remove a platform account.	Irreversible
`users:adaccess:read`	See which directory connections a platform user may work with.	View only
`users:adaccess:manage`	Grant or withdraw a platform user's access to directory connections.	Security-sensitive
`agents:list`	See every connected AI agent: whose account, role, directory, scope and supervision.	View only
`agents:manage`	Disconnect an agent or change its supervision.	Security-sensitive
`roles:list`	See the roles defined on the platform.	View only
`roles:read`	Open a role and view the permissions it grants.	View only
`roles:create`	Create roles, including from templates and by copying.	Security-sensitive
`roles:update`	Rename roles and change what they grant; in the console, also needed to change which roles a user holds.	Security-sensitive
`roles:assign-permissions`	Add or remove permissions on a role.	Security-sensitive
`roles:delete`	Delete roles; holders lose their rights.	Irreversible
`permissions:list`	See the full permission catalogue.	View only
`permissions:read`	View a single permission's details.	View only
`apikeys:list`	See the API keys issued on the platform.	View only
`apikeys:read`	Open an API key and view its settings.	View only
`apikeys:create`	Issue an API key for yourself.	Security-sensitive
`apikeys:create-for-user`	Issue an API key on behalf of someone else.	Security-sensitive
`apikeys:update`	Rename an API key or change its expiry and settings.	Changes data
`apikeys:revoke`	Switch an API key off immediately.	Irreversible
`apikeys:delete`	Permanently delete an API key.	Irreversible
`apikeys:binding:read`	See which directory connection an API key is tied to.	View only
`apikeys:binding:manage`	Tie an API key to a directory connection, or remove that link.	Security-sensitive

Oversight and control

Permission	Allows	Risk
`audit:list`	Read the operations log and change-history panels.	View only
`audit:verify`	Verify that the operations log has not been tampered with.	View only
`audit:export`	Export the operations log in bulk.	View only
`operations:waiting:list`	See your own operations waiting for approval.	View only
`operations:approve`	Approve or reject queued operations; set a credential to Unsupervised.	Security-sensitive
`audit:policies:list`	See Directory Policies and Attribute Policies.	View only
`audit:policies:read`	View a single operation's policy, and test what the attribute policies decide.	View only
`audit:policies:update`	Enable or disable operations and change their audit and agent settings; add, change or remove attribute policies.	Security-sensitive
`notifications:history`	Read the log of notifications sent.	View only
`notifications:manage`	Configure notification rules, templates and delivery.	Changes data
`feedback:history`	Read the feedback and bug reports users sent to Synergy.	View only

Platform administration

Permission	Allows	Risk
`adconnections:list`	See the directory connections.	View only
`adconnections:read`	View a connection's settings and test it; view the directory client settings.	View only
`adconnections:create`	Add a directory connection and its credentials.	Security-sensitive
`adconnections:update`	Change a connection or replace its credentials; change the directory client settings.	Security-sensitive
`adconnections:delete`	Remove a directory connection. Also requires system scope.	Irreversible
`license:read`	See the licence, its entitlements and expiry.	View only
`license:manage`	Enter, replace, refresh or remove the licence key.	Security-sensitive
`updates:read`	See the installed version, available updates, schedule and history.	View only
`updates:manage`	Change the update schedule, check for updates, approve an installation.	Security-sensitive
`telemetry:read`	See telemetry export and usage-statistics settings.	View only
`telemetry:manage`	Change the telemetry collector and usage-statistics consent.	Security-sensitive
`mcptools:list`	See the tools offered to AI agents.	View only
`mcptools:read`	Open a tool and view its definition.	View only
`mcptools:create`	Add a tool to the AI agent catalogue.	Changes data
`mcptools:update`	Change or reset a tool definition or its descriptions.	Changes data
`mcptools:reload`	Reload the tool catalogue.	Changes data
`mcptools:delete`	Remove a tool from the catalogue.	Irreversible

Note: Directory permissions (those starting with ad:) need an active licence: on an unlicensed installation they are refused with License.NotActivated, whatever the role grants. See Chapter 19, Licence, updates and backups.

Last updated 9 October 2026