Every team permission in Zuse Bifrost, entity by entity

The complete list of permissions a role or a group can grant, what each entity covers, and a plain sentence on what a member holding each permission can do.

This page is the reference to keep open while setting up roles and groups. It lists every permission Zuse Bifrost grants, what it governs, and a plain sentence on what a member holding it can do. The same codes are the abilities a personal access token can carry, so a token with work-item:view reads work items and nothing else about them.

How permissions are structured

Every permission has two parts, joined with a colon:

{entity}:{action}

Entity: the thing the permission acts on, such as project, work-item or webhook-endpoint.
Action: what may be done with it: view-any, view, create, update, delete, or a named action of that entity such as transition or sign-off.

There are 50 entities and 265 permissions in all. Most entities carry the same 5 actions; the ones with a lifecycle add named actions beside them (submit and approve on the planning artefacts, start and close on a sprint, execute and sign-off on a test run), and a few carry only read, use or manage because there is nothing to create or delete. Every count on this page is written from the permission catalogue on each build.

The five actions

Code	Meaning
`view-any`	See the list of every item of the entity the person may reach.
`view`	Open one item and read its details.
`create`	Add a new item.
`update`	Edit an existing item.
`delete`	Remove an item, or archive it where the record is kept.

view-any is listing access; view is detail access. Most roles want both, and the eight default roles grant both wherever they grant one, but splitting them lets a custom role open a record it is pointed at without browsing all of them.

A permission is a ceiling, not a key to every project

A permission says what a member may do in the team; which projects they may do it in is decided by project visibility and membership, and a guest of one project never holds a team permission at all. Members and guests has the rules.

Workspace

Team (`team`)

The team itself: its name, its existence and its settings.

Permission	What it lets the member do
`team:view-any`	See the list of teams they belong to.
`team:view`	Open a team and read its settings and members.
`team:create`	Create a new team, which they then own.
`team:update`	Rename a team and change its settings.
`team:delete`	Delete a team with everything it holds.

Team member (`team-member`)

The people in a team: inviting staff and guests, changing a role, removing someone.

Permission	What it lets the member do
`team-member:view-any`	See the roster of the team's members and pending invitations.
`team-member:view`	Open a member's row and read their role, groups and last activity.
`team-member:invite`	Invite a person by email with a role, or a client stakeholder as a guest of one project.
`team-member:remove`	Remove a member from the team, or cancel a pending invitation.
`team-member:update-role`	Change the role a member holds in the team.

Role (`role`)

The named sets of permissions a team hands to its members.

Permission	What it lets the member do
`role:view-any`	See every role of the team.
`role:view`	Open a role and read the permissions it carries.
`role:create`	Add a custom role with a chosen set of permissions.
`role:update`	Change a role's name, description and permissions.
`role:delete`	Delete a custom role nobody holds any more.

Group (`group`)

Named sets of permissions handed to several members on top of their roles.

Permission	What it lets the member do
`group:view-any`	See every group of the team.
`group:view`	Open a group and read its permissions and members.
`group:create`	Add a group with a chosen set of permissions.
`group:update`	Change a group's name, permissions and members.
`group:delete`	Delete a group; its members keep their roles.

API token (`token`)

Personal access tokens for the REST API, the MCP server and pipelines.

Permission	What it lets the member do
`token:view-any`	See the list of their own tokens.
`token:view`	Open one of their tokens and read its abilities and last use.
`token:create`	Mint a token carrying a subset of their own abilities.
`token:update`	Change a token's name.
`token:delete`	Revoke a token so its holder's next request is refused.

Webhook endpoint (`webhook-endpoint`)

The URLs that receive signed event payloads.

Permission	What it lets the member do
`webhook-endpoint:view-any`	See the team's webhook endpoints.
`webhook-endpoint:view`	Open an endpoint and read its subscriptions and recent deliveries.
`webhook-endpoint:create`	Register an endpoint and receive its signing secret.
`webhook-endpoint:update`	Change an endpoint's name, URL, events, allowed addresses; pause or resume it; rotate its secret; send it a test delivery.
`webhook-endpoint:delete`	Delete an endpoint and stop every delivery to it.

Webhook delivery (`webhook-delivery`)

The log of every event posted to an endpoint and what became of it.

Permission	What it lets the member do
`webhook-delivery:view-any`	See the delivery log, with its filters.
`webhook-delivery:view`	Open a delivery and read the payload, the attempts and the responses.
`webhook-delivery:retry`	Retry a failed or dead delivery, or every dead one at once.

Integration (`integration`)

The connections to outside services: the Git hosting app, the Telegram bot's team settings, CI tokens.

Permission	What it lets the member do
`integration:manage`	Connect, configure and disconnect the team's integrations.

Activity (`activity`)

The team's activity log: every change, who made it and where it came from.

Permission	What it lets the member do
`activity:read`	Read the team's activity log and a record's field-by-field history.

Dashboard (`dashboard`)

The overview pages that sum up the team's and a project's work.

Permission	What it lets the member do
`dashboard:read`	Open the overview and the project dashboards.

Report (`report`)

The reports hub: velocity, cycle time, test pass rates, SLA compliance, hours by client.

Permission	What it lets the member do
`report:read`	Open the reports and export them.

AI (`ai`)

Heimdall and every AI assist, and the team's monthly AI budget.

Permission	What it lets the member do
`ai:use`	Use the Heimdall panel, the AI assists and the quality reviews, within the rest of their role.
`ai:manage-budgets`	Change the team's monthly AI budget and its warning line under Settings → AI.

Clients and the project registry

Client (`client`)

The client accounts projects are run for.

Permission	What it lets the member do
`client:view-any`	See the list of clients.
`client:view`	Open a client and read its projects, stakeholders and open tickets.
`client:create`	Add a client.
`client:update`	Edit a client's details, contacts and status.
`client:delete`	Remove a client that has no projects.

Project (`project`)

The projects of the team, each the record of one engagement.

Permission	What it lets the member do
`project:view-any`	See the projects of the team they may see: every team-visible project plus the ones they are a member of.
`project:view`	Open a project and read its registry, record and dashboard.
`project:create`	Create a project, alone or through the intake wizard.
`project:update`	Edit a project's details, status, leads and settings.
`project:delete`	Archive, restore or delete a project and everything in it.

Project member (`project-member`)

Who is on a project beyond the team, with which project role.

Permission	What it lets the member do
`project-member:view-any`	See a project's members and their project roles.
`project-member:view`	Open a project member's row.
`project-member:create`	Add a team member to a project with a role override, or invite a client as a guest of it.
`project-member:update`	Change a project member's project role.
`project-member:delete`	Remove a member or a guest from a project.

Component (`component`)

A project's applications: the web app, the API, the mobile app, the services.

Permission	What it lets the member do
`component:view-any`	See a project's components.
`component:view`	Open a component and read its stack, repositories and environments.
`component:create`	Add a component to a project.
`component:update`	Edit a component's name, kind, stack and owner.
`component:delete`	Remove a component.

Environment (`environment`)

Where each component runs: development, staging, UAT, production and the rest.

Permission	What it lets the member do
`environment:view-any`	See a project's environments and their health.
`environment:view`	Open an environment and read its URLs, branch, version and current deployment.
`environment:create`	Register an environment.
`environment:update`	Edit an environment's URLs, branch, protection and health check.
`environment:delete`	Remove an environment.
`environment:deploy`	Deploy into an environment, or record a deployment made elsewhere.
`environment:freeze`	Freeze an environment for a change window, and lift the freeze.

Repository (`repository`)

The Git repositories connected to a project's components.

Permission	What it lets the member do
`repository:view-any`	See a project's connected repositories.
`repository:view`	Open a repository and read its branches, pull requests and linked work.
`repository:create`	Connect a repository to a component.
`repository:update`	Change which component a repository belongs to and its default branch.
`repository:delete`	Disconnect a repository.

Stakeholder (`stakeholder`)

The people on the client's side and beyond who sponsor, approve and sign off.

Permission	What it lets the member do
`stakeholder:view-any`	See a project's stakeholders.
`stakeholder:view`	Open a stakeholder and read their role, influence and approval flags.
`stakeholder:create`	Add a stakeholder.
`stakeholder:update`	Edit a stakeholder's details, RACI defaults and approval flags.
`stakeholder:delete`	Remove a stakeholder.

Persona (`persona`)

The user archetypes a project builds for.

Permission	What it lets the member do
`persona:view-any`	See a project's personas.
`persona:view`	Open a persona and read its goals, frustrations and behaviours.
`persona:create`	Add a persona.
`persona:update`	Edit a persona.
`persona:delete`	Archive or remove a persona.

Glossary (`glossary`)

The terms a project defines, linked wherever they appear.

Permission	What it lets the member do
`glossary:view-any`	See a project's glossary.
`glossary:view`	Open a term and read its definition and aliases.
`glossary:create`	Add a term.
`glossary:update`	Edit a term and its status.
`glossary:delete`	Remove a term.

Data entity (`data-entity`)

The data dictionary: the entities a project stores and their fields.

Permission	What it lets the member do
`data-entity:view-any`	See a project's data dictionary.
`data-entity:view`	Open an entity and read its fields.
`data-entity:create`	Add an entity or a field.
`data-entity:update`	Edit an entity, its fields and its status.
`data-entity:delete`	Remove an entity or a field.

Design reference (`design-reference`)

Links and uploads to designs, prototypes, API contracts and diagrams.

Permission	What it lets the member do
`design-reference:view-any`	See a project's design references.
`design-reference:view`	Open a design reference, its viewer or its upload.
`design-reference:create`	Add a design reference.
`design-reference:update`	Edit a design reference's title, version and notes.
`design-reference:delete`	Remove a design reference.

Planning

Epic (`epic`)

The large pieces of scope stories hang off.

Permission	What it lets the member do
`epic:view-any`	See a project's epics and the roadmap.
`epic:view`	Open an epic and read its stories, progress and history.
`epic:create`	Add an epic.
`epic:update`	Edit an epic that is not baselined.
`epic:delete`	Delete an epic.
`epic:submit`	Submit an epic for review.
`epic:approve`	Decide a review of an epic: approve it, request changes or reject it.

Work item (`work-item`)

Stories, tasks, sub-tasks, bugs, spikes and improvements on the backlog and the board.

Permission	What it lets the member do
`work-item:view-any`	See the backlog, the board and the defects.
`work-item:view`	Open a work item and read its criteria, links, tests, code, time and comments.
`work-item:create`	Add a story, task, sub-task, bug, spike or improvement.
`work-item:update`	Edit a work item's fields, criteria and labels.
`work-item:delete`	Delete a work item.
`work-item:transition`	Move a work item to another status, with the note a transition asks for.
`work-item:assign`	Assign a work item to a person, or take it.
`work-item:rank`	Reorder the backlog and the board columns.

Requirement (`requirement`)

Functional and non-functional requirements.

Permission	What it lets the member do
`requirement:view-any`	See a project's requirements.
`requirement:view`	Open a requirement and read its statement, measure, links and coverage.
`requirement:create`	Add a requirement.
`requirement:update`	Edit a requirement that is not baselined.
`requirement:delete`	Delete a requirement.
`requirement:submit`	Submit a requirement for review.
`requirement:approve`	Decide a review of a requirement.

Business rule (`business-rule`)

The rules the system must enforce, with their conditions, actions and examples.

Permission	What it lets the member do
`business-rule:view-any`	See a project's business rules.
`business-rule:view`	Open a rule and read its statement, examples and links.
`business-rule:create`	Add a business rule.
`business-rule:update`	Edit a rule that is not baselined.
`business-rule:delete`	Delete a business rule.
`business-rule:submit`	Submit a business rule for review.
`business-rule:approve`	Decide a review of a business rule.

Use case (`use-case`)

The flows an actor takes through the system, step by step.

Permission	What it lets the member do
`use-case:view-any`	See a project's use cases.
`use-case:view`	Open a use case and read its flows and steps.
`use-case:create`	Add a use case and its steps, or generate stories from a flow.
`use-case:update`	Edit a use case and its steps.
`use-case:delete`	Delete a use case.

RAID item (`raid`)

Risks, assumptions, issues and dependencies.

Permission	What it lets the member do
`raid:view-any`	See a project's RAID log and risk matrix.
`raid:view`	Open a RAID item and read its mitigation, owner and history.
`raid:create`	Raise a risk, an assumption, an issue or a dependency.
`raid:update`	Edit a RAID item and its status.
`raid:delete`	Delete a RAID item.

Decision (`decision`)

Architecture, product, process, vendor and security decisions with their options and consequences.

Permission	What it lets the member do
`decision:view-any`	See a project's decisions.
`decision:view`	Open a decision and read its context, options and consequences.
`decision:create`	Record a decision.
`decision:update`	Edit a decision and its status, or supersede it.
`decision:delete`	Delete a decision.

Link (`link`)

The traceability links between artefacts: implements, verifies, covers, depends on, blocks and the rest.

Permission	What it lets the member do
`link:view-any`	See the links of a record and the traceability matrix.
`link:view`	Open a link.
`link:create`	Link two artefacts.
`link:update`	Change a link's kind.
`link:delete`	Remove a link.

Baseline (`baseline`)

A frozen set of approved revisions: the scope at a point in time.

Permission	What it lets the member do
`baseline:view-any`	See a project's baselines and compare two.
`baseline:view`	Open a baseline and read what it froze.
`baseline:create`	Compose a baseline from approved artefacts.
`baseline:update`	Edit a baseline's name and notes before it is frozen.
`baseline:delete`	Delete a baseline that was never frozen.
`baseline:freeze`	Freeze a baseline, after which its items change only through a change request.

Approval (`approval`)

The review and sign-off requests on artefacts, releases, documents and runs.

Permission	What it lets the member do
`approval:view-any`	See the approvals inbox and a project's pending approvals.
`approval:view`	Open an approval request and read its revision, decisions and comments.
`approval:decide`	Approve, request changes or reject an approval assigned to them.
`approval:withdraw`	Withdraw an approval request they raised.
`approval:manage-policies`	Edit a project's approval policies: approvers, rules, quorums and SLAs.

Change request (`change-request`)

A proposed change to a baselined scope, with its impact and its approval.

Permission	What it lets the member do
`change-request:view-any`	See a project's change requests.
`change-request:view`	Open a change request and read its impact and the artefacts it touches.
`change-request:create`	Raise a change request.
`change-request:update`	Edit a change request before it is decided.
`change-request:delete`	Delete a change request that was never decided.
`change-request:analyse`	Record the impact analysis: scope, schedule, effort, cost and risk.
`change-request:approve`	Approve or reject a change request, which unlocks the baselined artefacts it names.
`change-request:verify`	Verify that an implemented change request delivered what it promised.

Comment (`comment`)

Comments on any record, with mentions and threads.

Permission	What it lets the member do
`comment:view-any`	Read the comments on records they can see.
`comment:view`	Open a comment thread.
`comment:create`	Write a comment.
`comment:update`	Edit their own comment.
`comment:delete`	Delete their own comment, or any comment on records they manage.
`comment:internal`	Write and read internal comments, hidden from client guests.

Attachment (`attachment`)

Files pinned on any record: wireframes, specifications, samples.

Permission	What it lets the member do
`attachment:view-any`	See the files on records they can see.
`attachment:view`	Open or save a file.
`attachment:create`	Upload a file onto a record, and remove their own.
`attachment:update`	Reserved for replacing a file in place; today a file is removed and attached again.
`attachment:delete`	Remove anyone's file.

AI import (`import`)

The brief imports the AI drafts a planning scaffold from, and their review queues.

Permission	What it lets the member do
`import:view-any`	See a project's import batches.
`import:view`	Open a batch and its review queue.
`import:create`	Start an import from pasted text, an upload or a knowledge entry.
`import:update`	Accept, edit, merge or reject the suggestions of a batch.
`import:delete`	Discard a batch.

Knowledge (`knowledge`)

What a project teaches: uploaded documents, notes and answers Heimdall and the search read.

Permission	What it lets the member do
`knowledge:view-any`	See a project's knowledge entries.
`knowledge:view`	Open an entry and read it.
`knowledge:create`	Add an entry or upload a document.
`knowledge:update`	Edit an entry and its audience.
`knowledge:delete`	Remove an entry.

Document (`document`)

Generated documents: BRD, SRS, sprint and status reports, release notes, sign-off sheets, test summaries, post-mortems.

Permission	What it lets the member do
`document:view-any`	See a project's generated documents.
`document:view`	Open or download a document.
`document:create`	Draft a document.
`document:update`	Edit a document's draft sections.
`document:delete`	Delete a draft document.
`document:render`	Render a document to its final file.
`document:finalise`	Finalise a document, after which it is versioned and shared.

Build

Sprint (`sprint`)

The timeboxes a project builds in.

Permission	What it lets the member do
`sprint:view-any`	See a project's sprints and burndowns.
`sprint:view`	Open a sprint and read its goal, scope, velocity and retrospective.
`sprint:create`	Plan a sprint and move work into it.
`sprint:update`	Edit a sprint's goal, dates, capacity and scope.
`sprint:delete`	Delete a planned sprint.
`sprint:start`	Start a sprint, which snapshots its commitment.
`sprint:close`	Close a sprint and decide where unfinished work goes.

Time log (`time-log`)

The time logged against work items and the weekly timesheets.

Permission	What it lets the member do
`time-log:view-any`	See the time logged on a project and the team's timesheets.
`time-log:view`	Open a time log.
`time-log:create`	Log time, by hand or with the timer.
`time-log:update`	Edit a time log that is not locked.
`time-log:delete`	Delete a time log that is not locked.
`time-log:approve`	Approve and lock a member's week.

Test

Test suite (`test-suite`)

The folders test cases are organised in.

Permission	What it lets the member do
`test-suite:view-any`	See a project's test suites.
`test-suite:view`	Open a suite and its cases.
`test-suite:create`	Add a suite.
`test-suite:update`	Rename or move a suite.
`test-suite:delete`	Delete an empty suite.

Test case (`test-case`)

The test cases with their steps, data and automation references.

Permission	What it lets the member do
`test-case:view-any`	See a project's test cases and the traceability matrix.
`test-case:view`	Open a test case and read its steps, coverage and results.
`test-case:create`	Write a test case, or accept ones the AI drafted.
`test-case:update`	Edit a test case and its steps.
`test-case:delete`	Delete a test case.
`test-case:approve`	Decide a review of a test case.

Test plan (`test-plan`)

What is tested when, where and by whom.

Permission	What it lets the member do
`test-plan:view-any`	See a project's test plans.
`test-plan:view`	Open a plan and read its scope, criteria and cases.
`test-plan:create`	Compose a test plan.
`test-plan:update`	Edit a plan and its cases.
`test-plan:delete`	Delete a draft plan.
`test-plan:approve`	Approve a test plan so its runs can start.

Test run (`test-run`)

The executions of a plan on an environment, with their results and defects.

Permission	What it lets the member do
`test-run:view-any`	See a project's test runs and their results.
`test-run:view`	Open a run and read every execution.
`test-run:create`	Start a run from a plan, or an ad-hoc one.
`test-run:update`	Edit a run's details and assignments.
`test-run:delete`	Delete a run that never started.
`test-run:execute`	Record results step by step, raise defects and import automation results.
`test-run:sign-off`	Sign off a UAT run as the client's representative.

Release

Release (`release`)

The versions composed from done work and shipped to the environments.

Permission	What it lets the member do
`release:view-any`	See a project's releases and their readiness.
`release:view`	Open a release and read its scope, checklist, approvals and notes.
`release:create`	Plan a release and compose its scope.
`release:update`	Edit a release's scope, dates, checklist and notes.
`release:delete`	Delete a release that was never released.
`release:freeze`	Declare the code freeze.
`release:approve`	Give the go-live approval.
`release:publish`	Publish the release notes to the client.
`release:rollback`	Roll a release back.

Deployment (`deployment`)

What went where: every deployment of a component into an environment.

Permission	What it lets the member do
`deployment:view-any`	See a project's deployments.
`deployment:view`	Open a deployment and read its pipeline, commit and outcome.
`deployment:create`	Start a deployment from the app.
`deployment:update`	Edit a deployment's notes.
`deployment:delete`	Delete a deployment record.
`deployment:record`	Record a deployment from a pipeline, as a CI token does.
`deployment:promote`	Approve a deployment into a protected environment.

Maintain

Incident (`incident`)

Production incidents with their severity, SLA timers, updates and post-mortems.

Permission	What it lets the member do
`incident:view-any`	See a project's incidents.
`incident:view`	Open an incident room and read its timeline.
`incident:create`	Open an incident.
`incident:update`	Edit an incident's severity, components and summary.
`incident:delete`	Delete an incident opened by mistake.
`incident:command`	Take command of an incident and assign responders.
`incident:resolve`	Resolve and close an incident.
`incident:publish-update`	Post an update, including the ones client guests see.

Support ticket (`ticket`)

The requests raised by clients and staff, with their SLAs and conversations.

Permission	What it lets the member do
`ticket:view-any`	See a project's tickets.
`ticket:view`	Open a ticket and read its conversation.
`ticket:create`	Raise a ticket.
`ticket:update`	Edit a ticket's category, priority and assignee.
`ticket:delete`	Delete a ticket.
`ticket:respond`	Reply to a ticket and write internal notes on it.
`ticket:convert`	Convert a ticket into a bug, a story or a change request.

Maintenance window (`maintenance-window`)

The announced windows an environment is worked on.

Permission	What it lets the member do
`maintenance-window:view-any`	See a project's maintenance windows and SLA policies.
`maintenance-window:view`	Open a maintenance window.
`maintenance-window:create`	Schedule a maintenance window.
`maintenance-window:update`	Edit or reschedule a window.
`maintenance-window:delete`	Cancel a window.

Roles — the eight default roles and the role editor
Groups — permissions handed to several members at once
API tokens — the same codes as token abilities
Ability catalogue — how the REST API and the MCP server enforce them

Ability Reference

How permissions are structuredCopy Anchor Link

The five actionsCopy Anchor Link

WorkspaceCopy Anchor Link

Team (team)Copy Anchor Link

Team member (team-member)Copy Anchor Link

Role (role)Copy Anchor Link

Group (group)Copy Anchor Link

API token (token)Copy Anchor Link

Webhook endpoint (webhook-endpoint)Copy Anchor Link

Webhook delivery (webhook-delivery)Copy Anchor Link

Integration (integration)Copy Anchor Link

Activity (activity)Copy Anchor Link

Dashboard (dashboard)Copy Anchor Link

Report (report)Copy Anchor Link

AI (ai)Copy Anchor Link

Clients and the project registryCopy Anchor Link

Client (client)Copy Anchor Link

Project (project)Copy Anchor Link

Project member (project-member)Copy Anchor Link

Component (component)Copy Anchor Link

Environment (environment)Copy Anchor Link

Repository (repository)Copy Anchor Link

Stakeholder (stakeholder)Copy Anchor Link

Persona (persona)Copy Anchor Link

Glossary (glossary)Copy Anchor Link

Data entity (data-entity)Copy Anchor Link

Design reference (design-reference)Copy Anchor Link

PlanningCopy Anchor Link

Epic (epic)Copy Anchor Link

Work item (work-item)Copy Anchor Link

Requirement (requirement)Copy Anchor Link

Business rule (business-rule)Copy Anchor Link

Use case (use-case)Copy Anchor Link

RAID item (raid)Copy Anchor Link

Decision (decision)Copy Anchor Link

Link (link)Copy Anchor Link

Baseline (baseline)Copy Anchor Link

Approval (approval)Copy Anchor Link

Change request (change-request)Copy Anchor Link

Comment (comment)Copy Anchor Link

Attachment (attachment)Copy Anchor Link

AI import (import)Copy Anchor Link

Knowledge (knowledge)Copy Anchor Link

Document (document)Copy Anchor Link

BuildCopy Anchor Link

Sprint (sprint)Copy Anchor Link

Time log (time-log)Copy Anchor Link

TestCopy Anchor Link

Test suite (test-suite)Copy Anchor Link

Test case (test-case)Copy Anchor Link

Test plan (test-plan)Copy Anchor Link

Test run (test-run)Copy Anchor Link

ReleaseCopy Anchor Link

Release (release)Copy Anchor Link

Deployment (deployment)Copy Anchor Link

MaintainCopy Anchor Link

Incident (incident)Copy Anchor Link

Support ticket (ticket)Copy Anchor Link

Maintenance window (maintenance-window)Copy Anchor Link

RelatedCopy Anchor Link

On this page