Roles and Permissions
Understand the permission model and configure fine-grained access control for your organization.
Permission Model
Lucaro uses a role-based access control (RBAC) model with two levels:
Workspace-Level Roles
Control access to workspace settings, members, and billing. Applied to all projects in the workspace.
Project-Level Roles
Control access to specific projects, dashboards, and data within a workspace.
Permission Matrix
| Permission | Owner | Admin | Editor | Viewer |
|---|---|---|---|---|
| Workspace | ||||
| View workspace | Yes | Yes | Yes | Yes |
| Manage members | Yes | Yes | No | No |
| Manage billing | Yes | No | No | No |
| Delete workspace | Yes | No | No | No |
| Projects | ||||
| Create projects | Yes | Yes | No | No |
| Edit project settings | Yes | Yes | No | No |
| Manage integrations | Yes | Yes | No | No |
| Content | ||||
| View dashboards | Yes | Yes | Yes | Yes |
| Create dashboards | Yes | Yes | Yes | No |
| Edit dashboards | Yes | Yes | Yes | No |
| Manage metrics registry | Yes | Yes | Yes | No |
| Create alerts | Yes | Yes | Yes | No |
| Export data | Yes | Yes | Yes | Yes |
Custom Roles (Enterprise)
Enterprise plans can create custom roles with specific permissions:
curl -X POST "https://api.lucaro.dev/v2/workspace/{workspaceId}/roles" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Analyst",
"permissions": [
"dashboards:read",
"dashboards:create",
"metrics:read",
"exports:create"
]
}'