Permissions by UI Location

This page maps each area of the Fides admin UI to the permissions that control it. Use it to work out what a user will see before you assign them a role — or to find out which permission is hiding something a user expects to find.

The Permissions Reference covers the same permissions organized by resource type, and describes what each one allows. This page answers the opposite question: what appears, and what disappears, in the interface.

The permission codes on this page are the same whether or not you use Advanced RBAC. Advanced RBAC lets you assemble them into custom roles; the built-in roles bundle them for you. Either way, the interface responds to the same codes. These codes are also referred to as scopes elsewhere in Fides and in the API.

How permissions affect what you see

A few things are worth knowing before you read the tables:

When a row lists more than one permission, any one of them is enough. A user does not need all of them.
If a user can't see any page in a section, the whole section disappears from the sidebar. Withholding a single permission can therefore hide more than one screen.
Hiding a page really does block it. A user can't get in by pasting the URL — they'll land back on the home page instead.
Some features also depend on whether they're turned on for your deployment. Early-access features, Fides Cloud features, and the consent module are switched on separately, and permissions won't bring back a feature that's turned off. These rows are marked below.
A few pages are open to anyone who can sign in and need no particular permission.
Editing a system is a special case: a user can edit it either with the system edit permission or by being that system's assigned steward. See System Stewardship.

Which sections a user sees

Section	Appears when the user has
Overview	Always
Detection & Discovery	`discovery_monitor:read`
Data inventory	Any of `datamap:read`, `system:read`, `system:create`, `ctl_dataset:create`, `ctl_dataset:update`
Integrations	Any `connection:*` permission, or `connection_type:read`
Privacy requests	Any of `privacy-request:read`, `privacy-request:create`, `manual_field:read-own`, `manual_field:read-all`, `policy:read`, `webhook:read`, `webhook:create_or_update`
Consent	Any of `privacy-notice:read`, `privacy-experience:read`
Data governance	Any of the taxonomy read permissions, `location:read`, `location:update`, or the early-access permissions listed below
Settings	Any of the settings permissions listed below

Overview

Page access

Page	Location	Required permissions
Home	Overview > Home	None — available to any signed-in user

Detection & Discovery

Page access

Page	Location	Required permissions
Action center	Detection & Discovery > Action center	`discovery_monitor:read`

In-page controls

Detection & Discovery has no permission checks on individual controls. See Areas without control-level permissions.

Data inventory

Page access

Page	Location	Required permissions
Data lineage	Data inventory > Data lineage	`datamap:read`
System inventory	Data inventory > System inventory	`system:read`
Add systems	Reached from System inventory, not the sidebar	`system:create`
Add system manually	Reached from Add systems	`system:create`
Add systems in bulk	Reached from Add systems	`system:create`
Manage datasets	Data inventory > Manage datasets	`ctl_dataset:create`, `ctl_dataset:update`
Data map report	Data inventory > Data map report	`datamap:read`
Asset report	Data inventory > Asset report	`datamap:read`

In-page controls

Control	Where it appears	Required permission
Delete system	System inventory row actions	`system:delete`
Edit system information	System detail form	`system:update`, or being the assigned steward for that system
Custom report selector	Data map report and Asset report toolbars	`custom_report:read`
Create report	Custom report menu	`custom_report:create`
Delete report	Custom report menu	`custom_report:delete`
Open integration editor	Dataset test panel	Requires both `connection:read` and `dataset:read`

Integrations

Page access

Page	Location	Required permissions
Integrations	Integrations > Integrations	`connection:read`, `connection:create_or_update`, `connection:delete`, `connection:authorize`, `connection:instantiate`, `connection_type:read`

In-page controls

Control	Where it appears	Required permission
Upload integration	Integrations toolbar	`connector_template:register`
Custom connector controls	Integration configuration form	`connector_template:register`

Privacy requests

Page access

Page	Location	Required permissions
Request manager	Privacy requests > Request manager	`privacy-request:read`, `privacy-request:create`, `manual_field:read-own`, `manual_field:read-all`
DSR policies	Privacy requests > DSR policies	`policy:read`
Pre-approval webhooks	Privacy requests > Pre-approval webhooks	`webhook:read`, `webhook:create_or_update`
Request workflows	Privacy requests > Request workflows	`privacy-request:read`

In-page controls

Control	Where it appears	Required permission
Requests tab	Request manager	`privacy-request:read`
DROP tab	Request manager	`privacy-request:read`
Manual tasks tab	Request manager	`manual_field:read-own`, `manual_field:read-all`
Submit new request	Request manager toolbar	`privacy-request:create`
Approve, deny, or finalize	Request row actions	`privacy-request:review`
Extend deadline	Request row actions	`privacy-request:review`
Delete request	Request row actions	`privacy-request:delete`
Download request results	Request detail	`privacy-request-access-results:read`
Download diagnostics	Request detail	`privacy-request:read`
View attachments	Request detail	`attachment:read`
Upload attachment	Request detail	`attachment:create`
Add comment	Request detail, activity tab	`comment:create`
See all users' manual tasks	Manual tasks tab	`manual_field:read-all` — without it, a user sees only their own tasks
Go to request	Manual task row actions	`privacy-request:read`

Consent

The entire Consent section is hidden when the consent module is turned off for your deployment, regardless of permissions.

Page access

Page	Location	Required permissions
Vendors	Consent > Vendors	`privacy-notice:read`
Notices	Consent > Notices	`privacy-notice:read`
Experiences	Consent > Experiences	`privacy-experience:read`
TCF version history	Reached from an experience, not the sidebar	`privacy-experience:read`
Consent report	Consent > Consent report	`privacy-notice:read`

In-page controls

Control	Where it appears	Required permission
Enable or edit notice	Notices row actions	`privacy-notice:update`
Enable or edit experience	Experiences row actions	`privacy-experience:update`
Upload custom CSS	Experiences toolbar	`custom_asset:update`
Create TCF configuration	Consent framework settings	`privacy-experience:create`
Delete TCF configuration	Consent framework settings	`privacy-experience:create`

Data governance

Page access

Page	Location	Required permissions
Taxonomy	Data governance > Taxonomy	`data_use:read`, `data_category:read`, `data_subject:read`
Purposes	Data governance > Purposes	`data_purpose:read` — early-access feature
Access policies	Data governance > Access policies	None, but an early-access feature
Data consumers	Data governance > Data consumers	`data_consumer:read` — early-access feature
Access control	Data governance > Access control	`discovery_monitor:read` — early-access feature
Assessments	Data governance > Assessments	`privacy_assessment:read` — early-access feature
Locations	Data governance > Locations	`location:read`, `location:update`
Regulations	Data governance > Regulations	`location:read`, `location:update`

In-page controls

Taxonomy controls follow a consistent pattern: each taxonomy type has its own set of permissions, and the control checks the permission belonging to whichever taxonomy you are viewing.

Control	Required permission
Add label	The `create` permission for that taxonomy
Edit label	The `update` permission for that taxonomy
Delete label	The `delete` permission for that taxonomy

The taxonomy types and their permission prefixes are:

Taxonomy	Permission prefix
Data categories	`data_category`
Data uses	`data_use`
Data subjects	`data_subject`
System groups	`system_group`
Custom taxonomies	`taxonomy`

For example, adding a data use requires data_use:create, and deleting a system group requires system_group:delete.

Other controls in this section:

Control	Where it appears	Required permission
Delete custom field definition	Taxonomy detail panel	`custom_field:delete`
Edit data purpose	Purposes row actions	`data_purpose:update`
Delete data purpose	Purposes row actions	`data_purpose:delete`
Add data consumer	Data consumers toolbar	`data_consumer:create`
Edit data consumer	Data consumers row actions	`data_consumer:update`
Delete data consumer	Data consumers row actions	`data_consumer:delete`

Settings

Page access

Page	Location	Required permissions
Organization	Settings > Organization	`organization:read`, `organization:update`
Users	Settings > Users	`user:read`, `user:create`, `user:update`, `user-permission:update`
User detail	Reached from Users, not the sidebar	None beyond access to Users
Role Management	Settings > Role Management	`user-permission:assign_owners` — only appears when Advanced RBAC is enabled
Notifications	Settings > Notifications	`messaging-template:update`, `digest_config:read`, `messaging:create_or_update`
Properties	Settings > Properties	`property:read`
Domain verification	Settings > Domain verification	`fides_cloud_config:read` — Fides Cloud only
Domains	Settings > Domains	`config:read`, `config:update`
Custom fields	Settings > Custom fields	`custom_field:read`
DSR configuration	Settings > DSR configuration	`privacy-request-redaction-patterns:update`
Consent framework	Settings > Consent framework	`tcf_publisher_override:read`, `tcf_publisher_override:update`
API clients	Settings > API clients	`client:read`
API client detail	Reached from API clients, not the sidebar	`client:read`
About Fides	Settings > About Fides	`user:read`, `feature_flag:read`

In-page controls

Users and permissions

Control	Where it appears	Required permission
Add new user	Users toolbar	`user:create`
Edit user	Users row actions	`user:update`, or editing your own profile
Delete user	Users row actions	`user:delete`
Resend invite	User detail	`user:create`
Permissions tab	User detail	`user-permission:update` — the tab is disabled without it
Assign the Owner role	Role selection on user detail	`user-permission:assign_owners`
Reset password	User detail	`user:password-reset`

Notifications

Control	Where it appears	Required permission
Messaging templates tab	Notifications tab bar	`messaging-template:update`
Digests tab	Notifications tab bar	`digest_config:read`
Email providers tab	Notifications tab bar	`messaging:create_or_update`
Chat providers tab	Notifications tab bar	`messaging:create_or_update` — early-access feature
Edit or delete messaging configuration	Email providers	`messaging:create_or_update`
Edit or delete chat configuration	Chat providers	`messaging:create_or_update`
Create digest	Digests toolbar	`digest_config:create`
Enable or edit digest	Digests row actions	`digest_config:create`, `digest_config:update`
Delete digest	Digests row actions	`digest_config:delete`

API clients

Control	Where it appears	Required permission
Create client	API clients toolbar	`client:create`
Edit client	API client detail	`client:update`
Rotate client secret	API client detail	`client:update`
Delete client	API client detail	`client:delete`

Properties, custom fields, and organization

Control	Where it appears	Required permission
Add property	Properties toolbar	`property:create`
Edit property	Properties row actions	`property:update`
Delete property	Properties row actions	`property:delete`
Custom field row actions	Custom fields table	`custom_field:update`
Delete custom field	Custom field form	`custom_field:delete`
Single sign-on settings	Organization settings	`openid_provider:create`
Feature flag panel	About Fides	`feature_flag:read`
Change a feature flag	About Fides	`feature_flag:update`

Home page tiles

The home page shows a tile for each major area. Tiles are hidden the same way pages are.

Tile	Required permission
View data map	`datamap:read`
View systems	`system:read`
Review privacy requests	`privacy-request:review`
Manage consent	`privacy-notice:read`

Some tiles also wait until there is something to show — the systems tile appears only once at least one system exists, and the privacy requests tile only once at least one integration is configured.

Areas without control-level permissions

Some areas check permissions only when deciding whether to show the page, not on the individual controls inside it. If you are auditing least-privilege access, these are worth knowing about:

Detection & Discovery, including the action center and monitor reports, is controlled entirely by discovery_monitor:read. A user who can open the section can use every control within it.
Data catalog surfaces sit within Detection & Discovery and behave the same way.

To restrict these areas, withhold discovery_monitor:read rather than relying on control-level permissions.

Permissions Reference Separation of Duties