Permission matrix

Every permission point, which built-in roles hold it, and the menu or API it guards.

Permission points are the first layer of the model. The second is business-group membership, and the two are combined with AND:

may edit this alert rule  =  my role holds the "edit alert rule" permission point
                             AND
                             one of my teams has write on the business group
                             that owns the rule

The model itself is in Authentication and permissions; this page is the lookup table.

Three built-in roles

Role	Reach
Admin	Skips the permission check — holds every point, and is not bounded by business-group membership either
Standard	Everyday users. Holds most points
Guest	Read-only observer. A dozen or so query points

Custom roles are created under Organization → Roles by ticking the points you want.

A user can hold several roles at once; permissions are the union.

The list

Points marked "menu visibility only" guard no endpoint — they decide whether a sidebar item shows, and the backend will not reject a request for lack of one. The points that list endpoints are the real gate.

96 permission points. The Admin role is not in this table — it skips the permission check in code, so it holds every point and is not bounded by business-group membership either.

A permission point is only the first layer. Whether you may act on a given object also depends on whether one of your teams has write on the business group that owns it — the two are combined with AND.

Permission point	Standard	Guest	Guards
/ai-config/llm-configs			GET /ai-llm-configs GET /ai-llm-config/:id POST /ai-llm-configs PUT /ai-llm-config/:id DELETE /ai-llm-config/:id POST /ai-llm-config/test
/ai-config/skills			GET /ai-skills GET /ai-skill/:id POST /ai-skills PUT /ai-skill/:id DELETE /ai-skill/:id POST /ai-skills/import PUT /ai-skill/:id/import POST /ai-skills/git/install PUT /ai-skill/:id/git/install POST /ai-skill/:id/git/update GET /ai-skill-file/:fileId DELETE /ai-skill-file/:fileId
/alert-cur-events	✅		(menu visibility only)
/alert-cur-events/del	✅		DELETE /alert-cur-events
/alert-his-events	✅		(menu visibility only)
/alert-mutes	✅		GET /busi-groups/alert-mutes GET /busi-group/:id/alert-mutes GET /busi-group/:id/alert-mute/:amid
/alert-mutes/add	✅		POST /busi-group/:id/alert-mutes/preview POST /busi-group/:id/alert-mutes POST /alert-mute-tryrun
/alert-mutes/del	✅		DELETE /busi-group/:id/alert-mutes
/alert-mutes/put			PUT /busi-group/:id/alert-mute/:amid PUT /busi-group/:id/alert-mutes/fields
/alert-rules	✅		GET /busi-groups/alert-rules GET /busi-group/:id/alert-rules GET /alert-rule/:arid GET /alert-rule/:arid/pure GET /alert-rule/:arid/eval-records
/alert-rules-built-in	✅		(menu visibility only)
/alert-rules/add	✅		POST /busi-group/:id/alert-rules POST /busi-group/:id/alert-rules/import POST /busi-group/:id/alert-rules/clone POST /busi-groups/alert-rules/clones POST /busi-group/alert-rules/notify-tryrun POST /busi-group/alert-rules/enable-tryrun POST /busi-group/:id/alert-rule/test-fire
/alert-rules/del	✅		DELETE /busi-group/:id/alert-rules
/alert-rules/put	✅		PUT /busi-group/:id/alert-rules/fields PUT /busi-group/:id/alert-rule/:arid PUT /busi-group/alert-rule/validate
/alert-subscribes	✅		GET /busi-groups/alert-subscribes GET /busi-group/:id/alert-subscribes GET /alert-subscribe/:sid
/alert-subscribes/add	✅		POST /busi-group/:id/alert-subscribes POST /alert-subscribe/alert-subscribes-tryrun
/alert-subscribes/del	✅		DELETE /busi-group/:id/alert-subscribes
/alert-subscribes/put	✅		PUT /busi-group/:id/alert-subscribes
/builtin-metrics/add			POST /builtin-metrics
/builtin-metrics/del			DELETE /builtin-metrics
/builtin-metrics/put			PUT /builtin-metrics
/busi-groups	✅		(menu visibility only)
/busi-groups/add	✅		POST /busi-groups
/busi-groups/del	✅		DELETE /busi-group/:id
/busi-groups/put	✅		PUT /busi-group/:id POST /busi-group/:id/members DELETE /busi-group/:id/members
/components/add			POST /builtin-components POST /builtin-payloads
/components/del			DELETE /builtin-components DELETE /builtin-payloads
/components/put			PUT /builtin-components PUT /builtin-payloads
/dashboards	✅		GET /busi-groups/public-boards GET /busi-groups/boards GET /busi-group/:id/boards
/dashboards-built-in	✅		(menu visibility only)
/dashboards/add	✅		POST /busi-group/:id/boards POST /busi-group/:id/board/:bid/clone POST /busi-groups/boards/clones
/dashboards/del	✅		DELETE /boards DELETE /dashboard-annotation/:id
/dashboards/put	✅		PUT /board/:bid PUT /board/:bid/configs PUT /board/:bid/public POST /dashboard-annotations PUT /dashboard-annotation/:id
/embedded-dashboards			GET /embedded-dashboards
/embedded-dashboards/put			PUT /embedded-dashboards
/embedded-product/add			POST /embedded-product
/embedded-product/delete			DELETE /embedded-product/:id
/embedded-product/put			PUT /embedded-products/weights PUT /embedded-product/:id/hide PUT /embedded-product/:id
/event-pipelines			GET /event-pipelines GET /event-pipeline/:id POST /event-pipeline-tryrun POST /event-processor-tryrun POST /event-pipeline/:id/trigger POST /event-pipeline/:id/stream GET /event-pipeline-executions GET /event-pipeline/:id/executions GET /event-pipeline/:id/execution/:exec_id GET /event-pipeline-execution/:exec_id GET /event-pipeline/:id/execution-stats
/event-pipelines/add			POST /event-pipeline
/event-pipelines/del			DELETE /event-pipelines
/event-pipelines/put			PUT /event-pipeline PUT /event-pipelines/disabled
/help/contact	✅	✅	(menu visibility only)
/help/migrate	✅		(menu visibility only)
/help/notification-settings			GET /notify-script GET /notify-channel GET /notify-config
/help/servers	✅		(menu visibility only)
/help/version	✅	✅	(menu visibility only)
/job-tasks	✅		GET /busi-groups/tasks GET /busi-group/:id/tasks
/job-tasks/add	✅		POST /busi-group/:id/tasks
/job-tasks/put	✅		(menu visibility only)
/job-tpls	✅		GET /busi-groups/task-tpls GET /busi-group/:id/task-tpls GET /busi-group/:id/task-tpl/:tid
/job-tpls/add	✅		POST /busi-group/:id/task-tpls
/job-tpls/del	✅		DELETE /busi-group/:id/task-tpl/:tid
/job-tpls/put	✅		POST /busi-group/:id/task-tpls/tags DELETE /busi-group/:id/task-tpls/tags PUT /busi-group/:id/task-tpl/:tid
/log/explorer	✅	✅	(menu visibility only)
/log/index-patterns/add			POST /es-index-pattern
/log/index-patterns/del			DELETE /es-index-pattern
/log/index-patterns/put			PUT /es-index-pattern PUT /es-index-patterns/weights
/metric/explorer	✅	✅	(menu visibility only)
/notification-channels			GET /notify-channel-config/:id GET /notify-channel-configs POST /feishu-visible-chats/:id POST /dingtalk-group-list/:id
/notification-channels/add			POST /notify-channel-configs POST /notify-channel-config/test
/notification-channels/del			DELETE /notify-channel-configs
/notification-channels/put			PUT /notify-channel-config/:id
/notification-rules			GET /notify-rule/:id GET /notify-rules POST /notify-rule/test GET /notify-rule/custom-params
/notification-rules/add			POST /notify-rules POST /notify-rule/event-pipelines-tryrun
/notification-rules/del			DELETE /notify-rules
/notification-rules/put			PUT /notify-rule/:id
/notification-templates			GET /message-template/:id
/notification-templates/add			POST /message-templates
/notification-templates/del			DELETE /message-templates
/notification-templates/put			PUT /message-template/:id
/object/explorer	✅	✅	(menu visibility only)
/recording-rules	✅		GET /busi-groups/recording-rules GET /busi-group/:id/recording-rules GET /recording-rule/:rrid PUT /recording-rule/:rrid
/recording-rules/add	✅		POST /busi-group/:id/recording-rules
/recording-rules/del	✅		DELETE /busi-group/:id/recording-rules
/recording-rules/put	✅		PUT /busi-group/:id/recording-rules/fields
/roles			GET /role/:id/ops
/roles/add			POST /roles
/roles/del			DELETE /role/:id
/roles/put			PUT /roles PUT /role/:id/ops
/system/alerting-engines			GET /servers
/system/variable-settings			GET /user-variable-configs POST /user-variable-config PUT /user-variable-config/:id DELETE /user-variable-config/:id
/targets	✅		(menu visibility only)
/targets/add	✅		(menu visibility only)
/targets/del	✅		DELETE /targets
/targets/put	✅		POST /targets/tags DELETE /targets/tags PUT /targets/note PUT /targets/bgids
/trace/dependencies	✅		(menu visibility only)
/trace/explorer	✅	✅	(menu visibility only)
/user-groups	✅		(menu visibility only)
/user-groups/add	✅		POST /user-groups
/user-groups/del	✅		DELETE /user-group/:id
/user-groups/put	✅		PUT /user-group/:id POST /user-group/:id/members DELETE /user-group/:id/members
/users	✅		GET /users
/users/add			POST /users
/users/del			DELETE /user/:id
/users/put			PUT /user/:id/profile PUT /user/:id/password