Roles & permissions

Stream Trace keeps authorization in its own application model. Permissions are grouped into roles, and roles are granted either globally or per team.

Scopes

• Global permissions apply instance-wide (managing users, reading the audit log).
• Team permissions apply to the streams owned by a specific team. A user gets team permissions by holding a team-scoped role on a team that owns the stream.

instance_admin is special: it holds every permission and bypasses stream ownership checks entirely.

Permissions

Global:

Permission	Grants
users.manage	Create, invite, update users; revoke sessions.
teams.manage	Create and update teams; manage membership.
roles.manage	Create, update, and delete custom roles.
stream_ownership.manage	Assign or override stream ownership.
audit.read	Read the audit log.
system.settings.read	Read effective system configuration.

Team-scoped:

Permission	Grants
streams.read	List streams and view metadata.
streams.messages.read	Read message metadata and non-sensitive payloads.
streams.messages.read_sensitive	Read full payloads (may contain sensitive data).
streams.messages.publish	Publish messages.
streams.messages.replay	Replay messages to consumers.
dlq.read	View DLQ cases.
dlq.manage	Retry and discard DLQ cases.
traces.read	View traces for in-scope streams.

Sensitive payloads. streams.messages.read lets a user see message metadata and non-sensitive payloads; full payload access requires streams.messages.read_sensitive. Grant it deliberately.

Built-in roles

Role	Scope	Permissions
instance_admin	global	All permissions; bypasses stream ownership.
security_auditor	global	audit.read, system.settings.read
access_admin	global	users.manage, teams.manage, roles.manage, stream_ownership.manage, system.settings.read
stream_admin	team	All team-scoped permissions
stream_operator	team	streams.read, streams.messages.read, streams.messages.publish, streams.messages.replay, dlq.read, dlq.manage, traces.read
stream_viewer	team	streams.read, streams.messages.read, dlq.read, traces.read
sensitive_viewer	team	streams.read, streams.messages.read, streams.messages.read_sensitive, dlq.read, traces.read

Other global roles only grant instance-level permissions - stream access always comes from team-scoped roles on teams that own a stream.

Custom roles

Users with roles.manage can create custom roles in the admin console, choosing any combination of the permissions above and a scope. See Administration and the Permissions reference.