Permissions reference

Every permission and which built-in role grants it.

Permissions are granted through roles, either globally or per team. instance_admin holds every permission and bypasses stream ownership.

Global permissions

Permission	`instance_admin`	`access_admin`	`security_auditor`
`users.manage`	✓	✓
`teams.manage`	✓	✓
`roles.manage`	✓	✓
`stream_ownership.manage`	✓	✓
`system.settings.read`	✓	✓	✓
`audit.read`	✓		✓

instance_admin also holds all of these (across every stream).

Permission	`stream_admin`	`stream_operator`	`sensitive_viewer`	`stream_viewer`
`streams.read`	✓	✓	✓	✓
`streams.messages.read`	✓	✓	✓	✓
`streams.messages.read_sensitive`	✓		✓
`streams.messages.publish`	✓	✓
`streams.messages.replay`	✓	✓
`dlq.read`	✓	✓	✓	✓
`dlq.manage`	✓	✓
`traces.read`	✓	✓	✓	✓

Permission	Gates
`users.manage`	Create/invite/update users; revoke sessions.
`teams.manage`	Create/update teams; manage membership.
`roles.manage`	Create/update/delete custom roles.
`stream_ownership.manage`	Assign/override stream ownership.
`audit.read`	Read the audit log (including DLQ audit).
`system.settings.read`	Read effective system configuration.
`streams.read`	List streams and view metadata.
`streams.messages.read`	Read message metadata and non-sensitive payloads.
`streams.messages.read_sensitive`	Read full (sensitive) payloads.
`streams.messages.publish`	Publish messages.
`streams.messages.replay`	Replay messages to consumers.
`dlq.read`	View DLQ cases.
`dlq.manage`	Retry/discard DLQ cases.
`traces.read`	View traces for in-scope streams.