From 8179c983d91d8e36f22c4a5bba0a2ee6948bd3a2 Mon Sep 17 00:00:00 2001 From: devin distefano Date: Mon, 26 Oct 2026 20:48:21 -0500 Subject: [PATCH 1/3] implement feedback and better descriptions for rbac roles and permissions --- src/content/chainlink-platform/api-keys.mdx | 277 +++++++-------- .../assigning-and-modifying-roles.mdx | 13 +- .../creating-an-account.mdx | 16 +- .../chainlink-platform/getting-started.mdx | 4 +- .../inviting-team-members.mdx | 26 +- src/content/chainlink-platform/rbac.mdx | 322 +++++++++++------- .../understanding-organizations.mdx | 22 +- src/content/data-streams/llms-full.txt | 10 +- 8 files changed, 374 insertions(+), 316 deletions(-) diff --git a/src/content/chainlink-platform/api-keys.mdx b/src/content/chainlink-platform/api-keys.mdx index e7294a40de6..b8221c4737c 100644 --- a/src/content/chainlink-platform/api-keys.mdx +++ b/src/content/chainlink-platform/api-keys.mdx @@ -6,7 +6,7 @@ metadata: title: "API Keys" description: "Learn how to create and manage API keys on the Chainlink Platform, including the permissions available for each product." datePublished: "2026-10-15" - lastModified: "2026-10-15" + lastModified: "2026-10-26" --- import { Aside, ProductSection } from "@components" @@ -19,22 +19,23 @@ An API key is an organization-level credential. When you create an API key, you - A single API key can include permissions for multiple products. For example, one key can deploy CRE workflows and read ACE reports. - API key permissions are a subset of all permissions. Some permissions, such as managing members or billing, are available only to organization members through their roles. -- An API key's access is determined by the permissions you select for it, not by your own role. +- An API key can act only within the permissions you select for it. +- You can give an API key only permissions that your own roles include. When you edit a key, you can keep permissions it already has even if your roles don't include them. To create and manage API keys, you need a role that includes API key permissions, such as Platform User, Platform Admin, or Owner. See [RBAC](/chainlink-platform/rbac) for the full list of roles. ## Available permissions -The following tables list the permissions you can assign to an API key for each product. Each row matches a permission group in the **API Scope** section of the creation form: the **Action** column is what to select for that group, and the **Permission ID** column lists the permission ID that the action grants. A check mark indicates that the role includes the permissions the action grants. The Owner role includes every permission for every product. +The following tables list the permissions you can assign to an API key for each product, grouped the same way as the **API Scope** section of the creation form. Role columns show which member roles include each permission, so you can match a key's access to a role. A check mark indicates that the role includes the permission. The Owner role includes every permission for every product. For what each role is for, and for the permissions available only to members, see [RBAC](/chainlink-platform/rbac). ### Chainlink Platform -| Name | Action | Permission ID | Admin | User | -| ------------- | ------ | ----------------------------- | ----- | ---- | -| Organization | Read | `platform:organization:read` | ✓ | ✓ | -| Owner address | Read | `platform:owner_address:read` | ✓ | ✓ | +| Permission | Description | Admin | User | +| ----------------------------- | ------------------------------------------------------ | ----- | ---- | +| `platform:organization:read` | View organization information. | ✓ | ✓ | +| `platform:owner_address:read` | View the organization's addresses in the address book. | ✓ | ✓ | @@ -42,13 +43,13 @@ The following tables list the permissions you can assign to an API key for each ### CRE -| Name | Action | Permission ID | Admin | Developer | Viewer | -| --------------------- | ------ | ------------------------------------------ | ----- | --------- | ------ | -| Workflow | Read | `cre:workflow:read` | ✓ | ✓ | ✓ | -| Workflow | Write | `cre:workflow:write/private_registry` | ✓ | ✓ | | -| Workflow artifact | Read | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | -| Workflow artifact | Write | `cre:workflow:artifact:write` | ✓ | ✓ | | -| Owner address linking | Write | `platform:owner_address:linking:write/cre` | ✓ | | | +| Permission | Description | Admin | Developer | Viewer | +| ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | ----- | --------- | ------ | +| `cre:workflow:read` | View workflows. | ✓ | ✓ | ✓ | +| `cre:workflow:artifact:read` | Download workflow artifacts. | ✓ | ✓ | ✓ | +| `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | ✓ | ✓ | | +| `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | ✓ | ✓ | | +| `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | ✓ | | | @@ -56,88 +57,88 @@ The following tables list the permissions you can assign to an API key for each ### ACE -#### Administration - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Member role | Write | `platform:member_role:write/ace` | ✓ | | | - -#### Policy Manager - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------------------------- | ------ | ------------------------------------------------- | ----- | -------- | ------ | -| Policy manager policy engine | Read | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | -| Policy manager policy engine | Write | `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | -| Policy manager policy engine archive | Write | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | -| Policy manager policy | Read | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | -| Policy manager policy | Write | `ace:policy_manager:policy:write` | ✓ | ✓ | | -| Policy manager policy archive | Write | `ace:policy_manager:policy:archive:write` | ✓ | ✓ | | -| Policy manager target | Read | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | -| Policy manager target | Write | `ace:policy_manager:target:write` | ✓ | ✓ | | -| Policy manager target archive | Write | `ace:policy_manager:target:archive:write` | ✓ | ✓ | | -| Policy manager target access | Read | `ace:policy_manager:target_access:read` | ✓ | | | -| Policy manager target access | Write | `ace:policy_manager:target_access:write` | ✓ | | | -| Policy manager implementation | Read | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | -| Policy manager implementation | Write | `ace:policy_manager:implementation:write` | ✓ | ✓ | | -| Policy manager implementation archive | Write | `ace:policy_manager:implementation:archive:write` | ✓ | | | - -#### Identity Manager - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------------------------- | ------ | --------------------------------------------- | ----- | -------- | ------ | -| Identity manager registry | Read | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | -| Identity manager registry | Write | `ace:identity_manager:registry:write` | ✓ | ✓ | | -| Identity manager registry archive | Write | `ace:identity_manager:registry:archive:write` | ✓ | | | -| Identity manager registry access | Read | `ace:identity_manager:registry_access:read` | ✓ | | | -| Identity manager registry access | Write | `ace:identity_manager:registry_access:write` | ✓ | | | -| Identity manager identity | Read | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | -| Identity manager identity | Write | `ace:identity_manager:identity:write` | ✓ | ✓ | | -| Identity manager identity archive | Write | `ace:identity_manager:identity:archive:write` | ✓ | ✓ | | - -#### Reporting - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Reporting policy | Read | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | -| Reporting identity | Read | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | -| Reporting target | Read | `ace:reporting:target:read` | ✓ | ✓ | ✓ | -| Reporting transaction | Read | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | -| Reporting permit | Read | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | -| Reporting registry | Read | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | - -#### Evaluation - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----------------- | ------ | ----------------------------- | ----- | -------- | ------ | -| Evaluation permit | Read | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | -| Evaluation permit | Write | `ace:evaluation:permit:write` | ✓ | ✓ | | - -#### Core - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------- | ------ | -------------------------- | ----- | -------- | ------ | -| Core org config | Read | `ace:core:org_config:read` | ✓ | ✓ | ✓ | -| Core network | Read | `ace:core:network:read` | ✓ | ✓ | ✓ | -| Core wallet | Read | `ace:core:wallet:read` | ✓ | ✓ | ✓ | -| Core wallet | Write | `ace:core:wallet:write` | ✓ | | | - -#### Active Monitoring - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------------------------ | ------ | ------------------------------------------------ | ----- | -------- | ------ | -| Active monitoring action variable | Read | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | -| Active monitoring contract group | Read | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | -| Active monitoring contract group | Write | `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | -| Active monitoring rule group | Read | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | -| Active monitoring rule group | Write | `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | -| Active monitoring monitored address | Read | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | -| Active monitoring monitored address | Write | `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | -| Active monitoring screening interval | Read | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | -| Active monitoring screening interval | Write | `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | -| Active monitoring decision log | Read | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | -| Active monitoring decision log | Write | `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | -| Active monitoring provider api key | Read | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | -| Active monitoring provider api key | Write | `ace:active_monitoring:provider_api_key:write` | ✓ | | | +**Policy manager** + +| Permission | Description | Admin | Operator | Viewer | +| ------------------------------------------------- | --------------------------------------------------------------------------------------- | ----- | -------- | ------ | +| `ace:policy_manager:policy_engine:read` | Read policy engines. | ✓ | ✓ | ✓ | +| `ace:policy_manager:policy_engine:write` | Create and update policy engine. | ✓ | ✓ | | +| `ace:policy_manager:policy_engine:archive:write` | Archive policy engine (affects everything deployed under it). | ✓ | | | +| `ace:policy_manager:policy:read` | Read policies and data validator instances. | ✓ | ✓ | ✓ | +| `ace:policy_manager:policy:write` | Create and update policy and data validator instances. | ✓ | ✓ | | +| `ace:policy_manager:policy:archive:write` | Archive policy and data validator instances. | ✓ | ✓ | | +| `ace:policy_manager:target:read` | Read targets and their protections. | ✓ | ✓ | ✓ | +| `ace:policy_manager:target:write` | Create and update target and its protections. | ✓ | ✓ | | +| `ace:policy_manager:target:archive:write` | Archive target and its protections. | ✓ | ✓ | | +| `ace:policy_manager:target_access:read` | Read a target's cross-org evaluation access grants. | ✓ | | | +| `ace:policy_manager:target_access:write` | Grant and revoke cross-org evaluation access to a target. | ✓ | | | +| `ace:policy_manager:implementation:read` | Read extractors and policy types. | ✓ | ✓ | ✓ | +| `ace:policy_manager:implementation:write` | Create and update extractor or policy type (updates affect every instance built on it). | ✓ | ✓ | | +| `ace:policy_manager:implementation:archive:write` | Archive extractor or policy type (affects every instance built on it). | ✓ | | | + +**Identity manager** + +| Permission | Description | Admin | Operator | Viewer | +| --------------------------------------------- | ------------------------------------------------------------------------------- | ----- | -------- | ------ | +| `ace:identity_manager:registry:read` | Read identity and credential registries, and credential types. | ✓ | ✓ | ✓ | +| `ace:identity_manager:registry:write` | Create and update identity or credential registry, and credential types. | ✓ | ✓ | | +| `ace:identity_manager:registry:archive:write` | Archive identity or credential registry (affects everything deployed under it). | ✓ | | | +| `ace:identity_manager:registry_access:read` | Read a registry's cross-org access grants. | ✓ | | | +| `ace:identity_manager:registry_access:write` | Grant and revoke cross-org read access to a registry. | ✓ | | | +| `ace:identity_manager:identity:read` | Read identities and credentials. | ✓ | ✓ | ✓ | +| `ace:identity_manager:identity:write` | Create and update identity, and assign credentials. | ✓ | ✓ | | +| `ace:identity_manager:identity:archive:write` | Archive identity and credentials. | ✓ | ✓ | | + +**Reporting** + +| Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | ------------------------------------------------- | ----- | -------- | ------ | +| `ace:reporting:policy:read` | Read the reporting service's policy view. | ✓ | ✓ | ✓ | +| `ace:reporting:identity:read` | Read the reporting service's identity view. | ✓ | ✓ | ✓ | +| `ace:reporting:target:read` | Read the reporting service's target view. | ✓ | ✓ | ✓ | +| `ace:reporting:transaction:read` | Read the reporting service's transaction view. | ✓ | ✓ | ✓ | +| `ace:reporting:permit:read` | Read the reporting service's permit view. | ✓ | ✓ | ✓ | +| `ace:reporting:registry:read` | Read the reporting service's registry usage view. | ✓ | ✓ | ✓ | + +**Evaluation** + +| Permission | Description | Admin | Operator | Viewer | +| ----------------------------- | ------------------------- | ----- | -------- | ------ | +| `ace:evaluation:permit:read` | Read evaluation permits. | ✓ | ✓ | ✓ | +| `ace:evaluation:permit:write` | Create evaluation permit. | ✓ | ✓ | | + +**Core** + +| Permission | Description | Admin | Operator | Viewer | +| -------------------------- | -------------------------- | ----- | -------- | ------ | +| `ace:core:org_config:read` | Read organization details. | ✓ | ✓ | ✓ | +| `ace:core:network:read` | Read supported networks. | ✓ | ✓ | ✓ | +| `ace:core:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | +| `ace:core:wallet:write` | Create wallet. | ✓ | | | + +**Active monitoring** + +| Permission | Description | Admin | Operator | Viewer | +| ------------------------------------------------ | --------------------------------------------------- | ----- | -------- | ------ | +| `ace:active_monitoring:action_variable:read` | Read action variables. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:contract_group:read` | Read contract groups. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:contract_group:write` | Create contract groups. | ✓ | ✓ | | +| `ace:active_monitoring:rule_group:read` | Read rule groups. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:rule_group:write` | Create and update rule groups. | ✓ | ✓ | | +| `ace:active_monitoring:monitored_address:read` | Read monitored addresses. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:monitored_address:write` | Add addresses to the screening watch list. | ✓ | ✓ | | +| `ace:active_monitoring:screening_interval:read` | Read the screening interval. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:screening_interval:write` | Set, remove, start and stop the screening interval. | ✓ | ✓ | | +| `ace:active_monitoring:decision_log:read` | Read decision logs. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:decision_log:write` | Dismiss and enforce decision logs. | ✓ | ✓ | | +| `ace:active_monitoring:provider_api_key:read` | Read screening-provider API key metadata. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:provider_api_key:write` | Set and remove screening-provider API keys. | ✓ | ✓ | | + +**Administration** + +| Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | -------------------------- | ----- | -------- | ------ | +| `platform:member_role:write/ace` | Change members' ACE roles. | ✓ | | | @@ -145,57 +146,57 @@ The following tables list the permissions you can assign to an API key for each ### CRE Connect -#### Core +**Core** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| -------------- | ------ | --------------------------- | ----- | -------- | ------ | -| Network | Read | `crec:network:read` | ✓ | ✓ | ✓ | -| Wallet | Read | `crec:wallet:read` | ✓ | ✓ | ✓ | -| Wallet | Write | `crec:wallet:write` | ✓ | ✓ | | -| Wallet archive | Write | `crec:wallet:archive:write` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| --------------------------- | ----------------------------------- | ----- | -------- | ------ | +| `crec:network:read` | Read available blockchain networks. | ✓ | ✓ | ✓ | +| `crec:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | +| `crec:wallet:write` | Create or update wallet. | ✓ | ✓ | | +| `crec:wallet:archive:write` | Archive wallet. | ✓ | | | -#### Operations +**Operations** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Operation | Read | `crec:operation:read` | ✓ | ✓ | ✓ | -| Operation | Write | `crec:operation:write` | ✓ | ✓ | | -| Operation signature | Write | `crec:operation:signature:write` | ✓ | ✓ | | +| Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | --------------------------------------------------------- | ----- | -------- | ------ | +| `crec:operation:read` | Read operations and search by initiator/signer/canceller. | ✓ | ✓ | ✓ | +| `crec:operation:write` | Create operation (draft or pre-signed). | ✓ | ✓ | | +| `crec:operation:signature:write` | Sign (finalize) or cancel operation. | ✓ | ✓ | | -#### Channels +**Channels** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------- | ------ | ---------------------------- | ----- | -------- | ------ | -| Channel | Read | `crec:channel:read` | ✓ | ✓ | ✓ | -| Channel | Write | `crec:channel:write` | ✓ | ✓ | | -| Channel archive | Write | `crec:channel:archive:write` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| ---------------------------- | ------------------------- | ----- | -------- | ------ | +| `crec:channel:read` | Read channels. | ✓ | ✓ | ✓ | +| `crec:channel:write` | Create or update channel. | ✓ | ✓ | | +| `crec:channel:archive:write` | Archive channel. | ✓ | | | -#### Watchers +**Watchers** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------- | ------ | ---------------------------- | ----- | -------- | ------ | -| Watcher | Read | `crec:watcher:read` | ✓ | ✓ | ✓ | -| Watcher | Write | `crec:watcher:write` | ✓ | ✓ | | -| Watcher archive | Write | `crec:watcher:archive:write` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| ---------------------------- | ------------------------- | ----- | -------- | ------ | +| `crec:watcher:read` | Read watchers. | ✓ | ✓ | ✓ | +| `crec:watcher:write` | Create or update watcher. | ✓ | ✓ | | +| `crec:watcher:archive:write` | Archive watcher. | ✓ | | | -#### Queries +**Queries** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----- | ------ | ------------------ | ----- | -------- | ------ | -| Query | Read | `crec:query:read` | ✓ | ✓ | ✓ | -| Query | Write | `crec:query:write` | ✓ | ✓ | | +| Permission | Description | Admin | Operator | Viewer | +| ------------------ | ------------- | ----- | -------- | ------ | +| `crec:query:read` | Read queries. | ✓ | ✓ | ✓ | +| `crec:query:write` | Create query. | ✓ | ✓ | | -#### Events +**Events** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----- | ------ | ----------------- | ----- | -------- | ------ | -| Event | Read | `crec:event:read` | ✓ | ✓ | ✓ | +| Permission | Description | Admin | Operator | Viewer | +| ----------------- | -------------------------------------------- | ----- | -------- | ------ | +| `crec:event:read` | Read events, run history, and search events. | ✓ | ✓ | ✓ | -#### Administration +**Administration** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----------- | ------ | --------------------------------- | ----- | -------- | ------ | -| Member role | Write | `platform:member_role:write/crec` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| --------------------------------- | ---------------------------------- | ----- | -------- | ------ | +| `platform:member_role:write/crec` | Change members' CRE Connect roles. | ✓ | | | @@ -209,7 +210,7 @@ API keys cannot be scoped to Data Streams. Data Streams uses its own authenticat {/* prettier-ignore */} ## Creating an API key @@ -217,12 +218,12 @@ API keys cannot be scoped to Data Streams. Data Streams uses its own authenticat To create an API key: 1. Sign in to app.chain.link. -1. Click on your account's icon in the top-right corner, then click on _Org settings_ in the dropdown to open the **Organization** page. +1. Click your account's icon in the top-right corner, then click **Org settings** in the dropdown to open the **Organization** page. 1. Click to open the **API Keys** tab and click **Create API Key**. 1. Enter a name for the key. 1. In the **API Scope** section, select the permissions for the key: - - Each product (Platform, ACE, CRE, and CRE Connect) has its own accordion. Expand the products the key needs access to. - - Each product has a preset: **None**, **Read**, **All**, or **Custom**. **Read** grants the product's read permissions, **All** grants every permission available for that product, and **Custom** is applied automatically when you change any individual permission. The Chainlink Platform accordion offers only **None**, **Read**, and **Custom**. + - Each product (Platform, ACE, CRE, and CRE Connect) has its own expandable section. Expand the products the key needs access to. + - Each product has a preset: **None**, **Read**, **All**, or **Custom**. **Read** grants the product's read permissions, **All** grants every permission available for that product, and **Custom** is applied automatically when you change any individual permission. The Chainlink Platform section offers only **None**, **Read**, and **Custom**. - To grant individual permissions instead of a preset, set each permission group to **None**, **Read**, or **All**. Some groups offer only a subset of these options. 1. Click **Create API Key**, then copy the key and click **Done**. diff --git a/src/content/chainlink-platform/assigning-and-modifying-roles.mdx b/src/content/chainlink-platform/assigning-and-modifying-roles.mdx index 7d8d3022b21..9eda90e468f 100644 --- a/src/content/chainlink-platform/assigning-and-modifying-roles.mdx +++ b/src/content/chainlink-platform/assigning-and-modifying-roles.mdx @@ -6,7 +6,7 @@ metadata: title: "Assigning and Modifying Roles" description: "Change the roles that organization members hold for each product: open a member's edit form from the Members tab, pick a role for each product, preview the permissions a role grants, and save." datePublished: "2026-10-20" - lastModified: "2026-10-20" + lastModified: "2026-10-26" --- import { ClickToZoom, ProductOnly } from "@components" @@ -19,11 +19,8 @@ For what each role includes, see [RBAC](/chainlink-platform/rbac). To add a new - You must be logged in to app.chain.link. - You must have a role that can manage member roles: - - The **Owner** and **Platform Admins** can manage member roles for all products. - - **Product Admins** (for example, a CRE Admin) can manage member roles for their product only. -- The member whose roles you want to change must already belong to your organization. If they don't, invite them first: see [Inviting Team Members](/chainlink-platform/inviting-team-members). - -You can only set roles for products that you have access to. + - The Owner and Platform Admins can manage member roles for all products. + - Product Admins (for example, a CRE Admin) can manage member roles for their product only. ## Adding or Modifying a member's roles @@ -63,11 +60,11 @@ You can only set roles for products that you have access to. Set a product to **No Access** to remove the member's access to that product. The **Platform** role is required and has no **No Access** option. -1. To preview what a role grants before saving, expand the product's accordion. It shows the role's description and the permissions the role includes, grouped by service. Products set to **No Access** show **No role selected**. +1. To preview what a role grants before saving, expand the product's dropdown. It shows the role's description and the permissions the role includes, grouped by service. Products set to **No Access** show **No role selected**. 1. Click **Save changes** to save your changes. diff --git a/src/content/chainlink-platform/creating-an-account.mdx b/src/content/chainlink-platform/creating-an-account.mdx index c575dfbed24..ad1f37be246 100644 --- a/src/content/chainlink-platform/creating-an-account.mdx +++ b/src/content/chainlink-platform/creating-an-account.mdx @@ -15,7 +15,7 @@ Before you can use the Chainlink Platform and its products, you need to create a There are two ways to create an account: -1. **Create a new organization**: Sign up directly on the Chainlink Platform. You'll become the _Owner_ of a new organization. +1. **Create a new organization**: Sign up directly on the Chainlink Platform. You'll become the Owner of a new organization. 1. **Join an existing organization**: Accept an invitation from an existing organization Owner. You'll become a member of that organization automatically after account creation. ## Prerequisites @@ -29,9 +29,9 @@ There are two ways to begin the account creation process: ### Option A: Create a new organization -In this option, you'll create a new organization and become the _Owner_ of that organization. The Owner role includes every permission for every product. See [RBAC](/chainlink-platform/rbac) to learn more about roles. +In this option, you'll create a new organization and become the Owner of that organization. The Owner role includes every permission for every product. See [RBAC](/chainlink-platform/rbac) to learn more about roles. -Go to app.chain.link and click the **"Create an account"** button. +Go to app.chain.link and click the **Create an account** button. @@ -60,7 +60,7 @@ Fill in the required information: 1. **Country**: Select your country from the dropdown 1. **Terms and policies**: Review and accept the Terms of Service and Privacy Policy -Click **"Continue"** to proceed. +Click **Continue** to proceed. @@ -140,7 +140,7 @@ Your recovery code is essential for regaining access to your account if you lose 1. Copy the recovery code displayed on the screen 1. Store it securely in a password manager or offline location 1. Check the box "I have safely recorded this code" -1. Click **"Continue"** to complete account creation +1. Click **Continue** to complete account creation - The first person to create an account for your organization automatically becomes the **Owner**. Members with the invite permission, such as Platform Admins and the Owner, can invite new members. See [RBAC](/chainlink-platform/rbac) for the full list of roles. + The first person to create an account for your organization automatically becomes the Owner. Members with the invite permission, such as Platform Admins and the Owner, can invite new members. See [RBAC](/chainlink-platform/rbac) for the full list of roles. ## Prerequisites - You must be logged in to app.chain.link - You must have a role that includes the invite permission, such as Platform Admin or Owner -- The email addresses you're inviting must belong to whitelisted domains ## Step 1: Navigate to Organization settings -In the top navbar, click on your account icon, and then navigate to **"Org settings"**. +In the top navbar, click on your account icon, and then navigate to **Org settings**. ## Step 3: Start the invitation process -Click the **"Invite member"** link in the top right corner. +Click the **Invite member** link in the top right corner. ## Step 5: Send invitations -Once you've set all the roles you want to define for the invited member, click the **"Send invite"** button in the bottom right corner. +Once you've set all the roles you want to define for the invited member, click the **Send invite** button in the bottom right corner. - The email addresses you invite must belong to domains that are whitelisted for CRE access. If an invited member's - domain is not whitelisted, they won't be able to complete the account creation process. - +1. **Access**: They'll immediately have access to your organization's resources, according to the roles you set. ## Related guides diff --git a/src/content/chainlink-platform/rbac.mdx b/src/content/chainlink-platform/rbac.mdx index ccea5b2c6f1..7bf0b1add2b 100644 --- a/src/content/chainlink-platform/rbac.mdx +++ b/src/content/chainlink-platform/rbac.mdx @@ -6,7 +6,7 @@ metadata: title: "RBAC (Role-Based Access Control)" description: "Learn how role-based access control (RBAC) works on the Chainlink Platform, including the roles available for each product and how to manage them." datePublished: "2026-10-15" - lastModified: "2026-10-15" + lastModified: "2026-10-26" --- import { Aside, ProductOnly, ProductSection } from "@components" @@ -23,7 +23,7 @@ Each organization member is assigned a role for each product. The role determine ## The Owner role -The first user to create an organization is automatically assigned the **Owner** role. The Owner role includes every permission for every product, including all future products. This covers: +The first user to create an organization is automatically assigned the Owner role. The Owner role includes every permission for every product, including all future products. This covers: - Managing members and their roles for every product - Creating and managing API keys @@ -33,37 +33,44 @@ There is exactly one Owner per organization, and the Owner role cannot be transf ## Roles and permissions -The tables below list the permissions included in each role. A check mark indicates that the role includes the permission. The Owner role includes every permission in every table. +Each product section below starts with a summary of its roles, followed by a table of the permissions each role includes. A check mark indicates that the role includes the permission. The Owner role includes every permission in every table. + +### Reading permission IDs + +Each permission has an ID in the format `product:resource:action`. You see these IDs when you choose API key permissions, and in error messages when a request is missing a permission. Most IDs follow the same few patterns: + +- **`read`** permissions let you view a resource. **`write`** permissions let you create and update it. +- **`archive:write`** permissions let you archive a resource. Archiving is separate from `write` because archiving some resources also affects everything built on them. For this reason, some roles can create and update a resource but not archive it. +- A suffix after a slash limits a permission to one scope. For example, `platform:member_role:write/cre` allows changing CRE roles only, and `platform:member_role:write/*` allows changing roles for every product. +- Permissions that start with `platform:` but end with a product scope, such as `platform:limits:write/cre`, are organization-level permissions limited to that product. They appear in that product's table. ### Chainlink Platform -Chainlink Platform roles control access to organization-level features such as members, API keys, addresses, billing, and limits. - -| Name | Action | Permission ID | Admin | User | -| --------------------- | ------ | ---------------------------------------- | ----- | ---- | -| Organization | Read | `platform:organization:read` | ✓ | ✓ | -| Organization | Write | `platform:organization:write` | ✓ | | -| Billing | Read | `platform:billing:read/*` | ✓ | ✓ | -| Billing | Write | `platform:billing:write/*` | ✓ | | -| Payments | Read | `platform:payments:read` | ✓ | ✓ | -| Payments | Write | `platform:payments:write` | ✓ | | -| Member | Read | `platform:member:read` | ✓ | ✓ | -| Member invite | Write | `platform:member_invite:write` | ✓ | | -| Member | Write | `platform:member:write` | ✓ | | -| Member role | Write | `platform:member_role:write/*` | ✓ | | -| Owner address | Read | `platform:owner_address:read` | ✓ | ✓ | -| Owner address | Write | `platform:owner_address:write` | ✓ | | -| API key | Read | `platform:api_key:read` | ✓ | ✓ | -| API key | Write | `platform:api_key:write` | ✓ | ✓ | -| Limits | Read | `platform:limits:read/platform` | ✓ | ✓ | -| Limits | Write | `platform:limits:write/platform` | ✓ | | -| Owner address linking | Write | `platform:owner_address:linking:write/*` | | | -| Limits | Read | `platform:limits:read/*` | | | -| Limits | Write | `platform:limits:write/*` | | | - -The last three permissions in the table are cross-product permissions that no Platform role includes. Product roles grant their product-scoped versions instead: for example, the CRE Admin role includes `platform:owner_address:linking:write/cre` and `platform:limits:write/cre`. +Chainlink Platform roles control access to organization-level features such as members, API keys, addresses, billing, and limits. Every member has a Platform role. + +| Role | Description | +| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Full access to manage the Chainlink Platform for your organization: invite and remove members, change any member's roles, and manage API keys. | +| User | For developers and operations team members. Can view organization information and members, and can view and create API keys. | + +| Permission | Description | Admin | User | +| -------------------------------- | ----------------------------------------------------------------- | ----- | ---- | +| `platform:organization:read` | View organization information. | ✓ | ✓ | +| `platform:organization:write` | Edit organization information. | ✓ | | +| `platform:billing:read/*` | View billing information for all products. | ✓ | ✓ | +| `platform:member:read` | View the members of the organization. | ✓ | ✓ | +| `platform:member_invite:write` | Invite new members to the organization. | ✓ | | +| `platform:member:write` | Remove members from the organization. | ✓ | | +| `platform:member_role:write/*` | Change members' roles for every product. | ✓ | | +| `platform:owner_address:read` | View the organization's addresses in the address book. | ✓ | ✓ | +| `platform:api_key:read` | View the organization's API keys. | ✓ | ✓ | +| `platform:api_key:write` | Create and edit API keys. | ✓ | ✓ | +| `platform:limits:read/platform` | View organization-level limits, such as the maximum overdraft. | ✓ | ✓ | +| `platform:limits:write/platform` | Change organization-level limits that support self-serve changes. | ✓ | | + +Only the Owner can change limits for every product (`platform:limits:write/*`). Product Admin roles include the product-scoped version instead. For example, the CRE Admin role includes `platform:limits:write/cre`. Only limits that support self-serve changes can be changed this way. To change other limits, contact Chainlink. @@ -73,18 +80,24 @@ The last three permissions in the table are cross-product permissions that no Pl CRE roles control access to workflows, secrets, limits, and workflow owner addresses. -| Name | Action | Permission ID | Admin | Developer | Viewer | -| --------------------- | ------ | ------------------------------------------ | ----- | --------- | ------ | -| Workflow | Read | `cre:workflow:read` | ✓ | ✓ | ✓ | -| Workflow artifact | Read | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | -| Workflow artifact | Write | `cre:workflow:artifact:write` | ✓ | ✓ | | -| Workflow | Write | `cre:workflow:write/private_registry` | ✓ | ✓ | | -| Secret | Read | `cre:secret:read` | ✓ | ✓ | ✓ | -| Secret | Write | `cre:secret:write` | ✓ | ✓ | | -| Member role | Write | `platform:member_role:write/cre` | ✓ | | | -| Owner address linking | Write | `platform:owner_address:linking:write/cre` | ✓ | | | -| Limits | Read | `platform:limits:read/cre` | ✓ | ✓ | ✓ | -| Limits | Write | `platform:limits:write/cre` | ✓ | | | +| Role | Description | +| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Full CRE access, including managing secrets, changing CRE limits and roles, and linking workflow owner addresses, which is required to deploy workflows to the onchain registry. | +| Developer | Deploy, pause, and delete workflows in the private registry, and manage secrets. Cannot link workflow owner addresses, so cannot deploy to the onchain registry. | +| Viewer | View-only access to CRE, for monitoring workflows in the UI. | + +| Permission | Description | Admin | Developer | Viewer | +| ------------------------------------------ | -------------------------------------------------------------------------------------------------------- | ----- | --------- | ------ | +| `cre:workflow:read` | View workflows. | ✓ | ✓ | ✓ | +| `cre:workflow:artifact:read` | Download workflow artifacts. | ✓ | ✓ | ✓ | +| `cre:workflow:artifact:write` | Upload workflow artifacts, which is required to deploy a workflow. | ✓ | ✓ | | +| `cre:workflow:write/private_registry` | Deploy, pause, activate, and delete workflows in the private registry. | ✓ | ✓ | | +| `cre:secret:read` | List secrets. | ✓ | ✓ | ✓ | +| `cre:secret:write` | Create, update, and delete secrets. | ✓ | ✓ | | +| `platform:owner_address:linking:write/cre` | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | ✓ | | | +| `platform:limits:read/cre` | View CRE limits, such as the maximum spend per workflow execution. | ✓ | ✓ | ✓ | +| `platform:limits:write/cre` | Change CRE limits that support self-serve changes, such as the maximum spend per workflow execution. | ✓ | | | +| `platform:member_role:write/cre` | Change members' CRE roles. | ✓ | | | @@ -94,83 +107,94 @@ CRE roles control access to workflows, secrets, limits, and workflow owner addre ACE roles control access to policy engines, policies, targets, identities, evaluations, and active monitoring. +| Role | Description | +| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Full ACE access, including archiving policy engines and registries, granting cross-org access, and changing members' ACE roles. | +| Operator | Create and manage policies, targets, identities, evaluations, and active monitoring. Cannot archive policy engines, registries, extractors, or policy types, create wallets, or grant cross-org access. | +| Viewer | View-only access to ACE. | + **Policy manager** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------------------------- | ------ | ------------------------------------------------- | ----- | -------- | ------ | -| Policy manager policy engine | Read | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | -| Policy manager policy engine | Write | `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | -| Policy manager policy engine archive | Write | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | -| Policy manager policy | Read | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | -| Policy manager policy | Write | `ace:policy_manager:policy:write` | ✓ | ✓ | | -| Policy manager policy archive | Write | `ace:policy_manager:policy:archive:write` | ✓ | ✓ | | -| Policy manager target | Read | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | -| Policy manager target | Write | `ace:policy_manager:target:write` | ✓ | ✓ | | -| Policy manager target archive | Write | `ace:policy_manager:target:archive:write` | ✓ | ✓ | | -| Policy manager target access | Read | `ace:policy_manager:target_access:read` | ✓ | | | -| Policy manager target access | Write | `ace:policy_manager:target_access:write` | ✓ | | | -| Policy manager implementation | Read | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | -| Policy manager implementation | Write | `ace:policy_manager:implementation:write` | ✓ | ✓ | | -| Policy manager implementation archive | Write | `ace:policy_manager:implementation:archive:write` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| ------------------------------------------------- | --------------------------------------------------------------------------------------- | ----- | -------- | ------ | +| `ace:policy_manager:policy_engine:read` | Read policy engines. | ✓ | ✓ | ✓ | +| `ace:policy_manager:policy_engine:write` | Create and update policy engine. | ✓ | ✓ | | +| `ace:policy_manager:policy_engine:archive:write` | Archive policy engine (affects everything deployed under it). | ✓ | | | +| `ace:policy_manager:policy:read` | Read policies and data validator instances. | ✓ | ✓ | ✓ | +| `ace:policy_manager:policy:write` | Create and update policy and data validator instances. | ✓ | ✓ | | +| `ace:policy_manager:policy:archive:write` | Archive policy and data validator instances. | ✓ | ✓ | | +| `ace:policy_manager:target:read` | Read targets and their protections. | ✓ | ✓ | ✓ | +| `ace:policy_manager:target:write` | Create and update target and its protections. | ✓ | ✓ | | +| `ace:policy_manager:target:archive:write` | Archive target and its protections. | ✓ | ✓ | | +| `ace:policy_manager:target_access:read` | Read a target's cross-org evaluation access grants. | ✓ | | | +| `ace:policy_manager:target_access:write` | Grant and revoke cross-org evaluation access to a target. | ✓ | | | +| `ace:policy_manager:implementation:read` | Read extractors and policy types. | ✓ | ✓ | ✓ | +| `ace:policy_manager:implementation:write` | Create and update extractor or policy type (updates affect every instance built on it). | ✓ | ✓ | | +| `ace:policy_manager:implementation:archive:write` | Archive extractor or policy type (affects every instance built on it). | ✓ | | | **Identity manager** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------------------------- | ------ | --------------------------------------------- | ----- | -------- | ------ | -| Identity manager registry | Read | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | -| Identity manager registry | Write | `ace:identity_manager:registry:write` | ✓ | ✓ | | -| Identity manager registry archive | Write | `ace:identity_manager:registry:archive:write` | ✓ | | | -| Identity manager registry access | Read | `ace:identity_manager:registry_access:read` | ✓ | | | -| Identity manager registry access | Write | `ace:identity_manager:registry_access:write` | ✓ | | | -| Identity manager identity | Read | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | -| Identity manager identity | Write | `ace:identity_manager:identity:write` | ✓ | ✓ | | -| Identity manager identity archive | Write | `ace:identity_manager:identity:archive:write` | ✓ | ✓ | | - -**Reporting and evaluation** - -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Reporting policy | Read | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | -| Reporting identity | Read | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | -| Reporting target | Read | `ace:reporting:target:read` | ✓ | ✓ | ✓ | -| Reporting transaction | Read | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | -| Reporting permit | Read | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | -| Reporting registry | Read | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | -| Evaluation permit | Read | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | -| Evaluation permit | Write | `ace:evaluation:permit:write` | ✓ | ✓ | | +| Permission | Description | Admin | Operator | Viewer | +| --------------------------------------------- | ------------------------------------------------------------------------------- | ----- | -------- | ------ | +| `ace:identity_manager:registry:read` | Read identity and credential registries, and credential types. | ✓ | ✓ | ✓ | +| `ace:identity_manager:registry:write` | Create and update identity or credential registry, and credential types. | ✓ | ✓ | | +| `ace:identity_manager:registry:archive:write` | Archive identity or credential registry (affects everything deployed under it). | ✓ | | | +| `ace:identity_manager:registry_access:read` | Read a registry's cross-org access grants. | ✓ | | | +| `ace:identity_manager:registry_access:write` | Grant and revoke cross-org read access to a registry. | ✓ | | | +| `ace:identity_manager:identity:read` | Read identities and credentials. | ✓ | ✓ | ✓ | +| `ace:identity_manager:identity:write` | Create and update identity, and assign credentials. | ✓ | ✓ | | +| `ace:identity_manager:identity:archive:write` | Archive identity and credentials. | ✓ | ✓ | | + +**Reporting** + +| Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | ------------------------------------------------- | ----- | -------- | ------ | +| `ace:reporting:policy:read` | Read the reporting service's policy view. | ✓ | ✓ | ✓ | +| `ace:reporting:identity:read` | Read the reporting service's identity view. | ✓ | ✓ | ✓ | +| `ace:reporting:target:read` | Read the reporting service's target view. | ✓ | ✓ | ✓ | +| `ace:reporting:transaction:read` | Read the reporting service's transaction view. | ✓ | ✓ | ✓ | +| `ace:reporting:permit:read` | Read the reporting service's permit view. | ✓ | ✓ | ✓ | +| `ace:reporting:registry:read` | Read the reporting service's registry usage view. | ✓ | ✓ | ✓ | + +**Evaluation** + +| Permission | Description | Admin | Operator | Viewer | +| ----------------------------- | ------------------------- | ----- | -------- | ------ | +| `ace:evaluation:permit:read` | Read evaluation permits. | ✓ | ✓ | ✓ | +| `ace:evaluation:permit:write` | Create evaluation permit. | ✓ | ✓ | | **Core** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| --------------- | ------ | -------------------------- | ----- | -------- | ------ | -| Core org config | Read | `ace:core:org_config:read` | ✓ | ✓ | ✓ | -| Core network | Read | `ace:core:network:read` | ✓ | ✓ | ✓ | -| Core wallet | Read | `ace:core:wallet:read` | ✓ | ✓ | ✓ | -| Core wallet | Write | `ace:core:wallet:write` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| -------------------------- | -------------------------- | ----- | -------- | ------ | +| `ace:core:org_config:read` | Read organization details. | ✓ | ✓ | ✓ | +| `ace:core:network:read` | Read supported networks. | ✓ | ✓ | ✓ | +| `ace:core:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | +| `ace:core:wallet:write` | Create wallet. | ✓ | | | **Active monitoring** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------------------------ | ------ | ------------------------------------------------ | ----- | -------- | ------ | -| Active monitoring action variable | Read | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | -| Active monitoring contract group | Read | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | -| Active monitoring contract group | Write | `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | -| Active monitoring rule group | Read | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | -| Active monitoring rule group | Write | `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | -| Active monitoring monitored address | Read | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | -| Active monitoring monitored address | Write | `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | -| Active monitoring screening interval | Read | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | -| Active monitoring screening interval | Write | `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | -| Active monitoring decision log | Read | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | -| Active monitoring decision log | Write | `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | -| Active monitoring provider api key | Read | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | -| Active monitoring provider api key | Write | `ace:active_monitoring:provider_api_key:write` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| ------------------------------------------------ | --------------------------------------------------- | ----- | -------- | ------ | +| `ace:active_monitoring:action_variable:read` | Read action variables. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:contract_group:read` | Read contract groups. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:contract_group:write` | Create contract groups. | ✓ | ✓ | | +| `ace:active_monitoring:rule_group:read` | Read rule groups. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:rule_group:write` | Create and update rule groups. | ✓ | ✓ | | +| `ace:active_monitoring:monitored_address:read` | Read monitored addresses. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:monitored_address:write` | Add addresses to the screening watch list. | ✓ | ✓ | | +| `ace:active_monitoring:screening_interval:read` | Read the screening interval. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:screening_interval:write` | Set, remove, start and stop the screening interval. | ✓ | ✓ | | +| `ace:active_monitoring:decision_log:read` | Read decision logs. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:decision_log:write` | Dismiss and enforce decision logs. | ✓ | ✓ | | +| `ace:active_monitoring:provider_api_key:read` | Read screening-provider API key metadata. | ✓ | ✓ | ✓ | +| `ace:active_monitoring:provider_api_key:write` | Set and remove screening-provider API keys. | ✓ | ✓ | | **Administration** -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ----------- | ------ | -------------------------------- | ----- | -------- | ------ | -| Member role | Write | `platform:member_role:write/ace` | ✓ | | | +| Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | -------------------------- | ----- | -------- | ------ | +| `platform:member_role:write/ace` | Change members' ACE roles. | ✓ | | | @@ -180,25 +204,63 @@ ACE roles control access to policy engines, policies, targets, identities, evalu CRE Connect roles control access to operations, wallets, channels, watchers, queries, and events. -| Name | Action | Permission ID | Admin | Operator | Viewer | -| ------------------- | ------ | --------------------------------- | ----- | -------- | ------ | -| Network | Read | `crec:network:read` | ✓ | ✓ | ✓ | -| Operation | Read | `crec:operation:read` | ✓ | ✓ | ✓ | -| Operation | Write | `crec:operation:write` | ✓ | ✓ | | -| Operation signature | Write | `crec:operation:signature:write` | ✓ | ✓ | | -| Wallet | Read | `crec:wallet:read` | ✓ | ✓ | ✓ | -| Wallet | Write | `crec:wallet:write` | ✓ | ✓ | | -| Wallet archive | Write | `crec:wallet:archive:write` | ✓ | | | -| Channel | Read | `crec:channel:read` | ✓ | ✓ | ✓ | -| Channel | Write | `crec:channel:write` | ✓ | ✓ | | -| Channel archive | Write | `crec:channel:archive:write` | ✓ | | | -| Watcher | Read | `crec:watcher:read` | ✓ | ✓ | ✓ | -| Watcher | Write | `crec:watcher:write` | ✓ | ✓ | | -| Watcher archive | Write | `crec:watcher:archive:write` | ✓ | | | -| Query | Read | `crec:query:read` | ✓ | ✓ | ✓ | -| Query | Write | `crec:query:write` | ✓ | ✓ | | -| Event | Read | `crec:event:read` | ✓ | ✓ | ✓ | -| Member role | Write | `platform:member_role:write/crec` | ✓ | | | +| Role | Description | +| -------- | ---------------------------------------------------------------------------------------------------------------------- | +| Admin | Full CRE Connect access, including archiving wallets, channels, and watchers, and changing members' CRE Connect roles. | +| Operator | Create and manage operations, wallets, channels, watchers, and queries. Cannot archive resources. | +| Viewer | View-only access to CRE Connect. | + +**Core** + +| Permission | Description | Admin | Operator | Viewer | +| --------------------------- | ----------------------------------- | ----- | -------- | ------ | +| `crec:network:read` | Read available blockchain networks. | ✓ | ✓ | ✓ | +| `crec:wallet:read` | Read wallets. | ✓ | ✓ | ✓ | +| `crec:wallet:write` | Create or update wallet. | ✓ | ✓ | | +| `crec:wallet:archive:write` | Archive wallet. | ✓ | | | + +**Operations** + +| Permission | Description | Admin | Operator | Viewer | +| -------------------------------- | --------------------------------------------------------- | ----- | -------- | ------ | +| `crec:operation:read` | Read operations and search by initiator/signer/canceller. | ✓ | ✓ | ✓ | +| `crec:operation:write` | Create operation (draft or pre-signed). | ✓ | ✓ | | +| `crec:operation:signature:write` | Sign (finalize) or cancel operation. | ✓ | ✓ | | + +**Channels** + +| Permission | Description | Admin | Operator | Viewer | +| ---------------------------- | ------------------------- | ----- | -------- | ------ | +| `crec:channel:read` | Read channels. | ✓ | ✓ | ✓ | +| `crec:channel:write` | Create or update channel. | ✓ | ✓ | | +| `crec:channel:archive:write` | Archive channel. | ✓ | | | + +**Watchers** + +| Permission | Description | Admin | Operator | Viewer | +| ---------------------------- | ------------------------- | ----- | -------- | ------ | +| `crec:watcher:read` | Read watchers. | ✓ | ✓ | ✓ | +| `crec:watcher:write` | Create or update watcher. | ✓ | ✓ | | +| `crec:watcher:archive:write` | Archive watcher. | ✓ | | | + +**Queries** + +| Permission | Description | Admin | Operator | Viewer | +| ------------------ | ------------- | ----- | -------- | ------ | +| `crec:query:read` | Read queries. | ✓ | ✓ | ✓ | +| `crec:query:write` | Create query. | ✓ | ✓ | | + +**Events** + +| Permission | Description | Admin | Operator | Viewer | +| ----------------- | -------------------------------------------- | ----- | -------- | ------ | +| `crec:event:read` | Read events, run history, and search events. | ✓ | ✓ | ✓ | + +**Administration** + +| Permission | Description | Admin | Operator | Viewer | +| --------------------------------- | ---------------------------------- | ----- | -------- | ------ | +| `platform:member_role:write/crec` | Change members' CRE Connect roles. | ✓ | | | @@ -208,9 +270,13 @@ CRE Connect roles control access to operations, wallets, channels, watchers, que Data Streams has a single role. -| Name | Action | Permission ID | Admin | -| ----------- | ------ | ---------------------------------------- | ----- | -| Member role | Write | `platform:member_role:write/datastreams` | ✓ | +| Role | Description | +| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Admin | Access to your organization's Data Streams subscription, and the ability to assign other members as Data Streams Admins. Each member gets their own API credentials while sharing access to the organization's Data Streams. | + +| Permission | Description | Admin | +| ---------------------------------------- | ----------------------------------- | ----- | +| `platform:member_role:write/datastreams` | Change members' Data Streams roles. | ✓ | @@ -223,9 +289,9 @@ Data Streams has a single role. Members with the appropriate permissions can assign and change roles for other members: -- **Platform Admins** can manage member roles for all products. -- **Product Admins** (for example, CRE Admins) can manage member roles for their product. -- The **Owner** can manage member roles for all products. +- Platform Admins can manage member roles for all products. +- Product Admins (for example, CRE Admins) can manage member roles for their product. +- The Owner can manage member roles for all products. To assign or change a member's roles, see [Assigning and Modifying Roles](/chainlink-platform/assigning-and-modifying-roles). diff --git a/src/content/chainlink-platform/understanding-organizations.mdx b/src/content/chainlink-platform/understanding-organizations.mdx index 641baa42b9d..467c4913d92 100644 --- a/src/content/chainlink-platform/understanding-organizations.mdx +++ b/src/content/chainlink-platform/understanding-organizations.mdx @@ -4,16 +4,16 @@ date: Last Modified title: "Understanding Organizations" metadata: title: "Understanding Organizations" - description: "Understand Chainlink Platform organizations: learn about the Owner role, per-product member roles, API keys, and how teams collaborate on workflows." + description: "Understand Chainlink Platform organizations: learn about the Owner role, per-product member roles, API keys, and how teams collaborate across products." datePublished: "2025-11-04" - lastModified: "2026-10-15" + lastModified: "2026-10-26" --- import { ProductOnly } from "@components" ## What is an organization? -A Chainlink Platform organization is a collaborative workspace that allows multiple team members to deploy, manage, and monitor workflows together. When you create an account, you either start a new organization (becoming the _Owner_) or join an existing one (becoming a member). +A Chainlink Platform organization is a shared workspace where your team works together across Chainlink products. When you create an account, you either start a new organization (becoming the Owner) or join an existing one (becoming a member). An organization serves as a container for: @@ -22,7 +22,7 @@ An organization serves as a container for: - **Product resources** such as CRE workflows, ACE policies, and CRE Connect channels, visible to members according to their roles - **API keys** for programmatic access to products -Organizations enable teams to collaborate on workflows while maintaining individual control over their own wallet addresses and secrets. +Organizations enable teams to collaborate across Chainlink products. ## Organization structure @@ -37,13 +37,7 @@ Every organization has exactly **one Owner**: the person who first created the o ### Multiple Members -Members are users invited to join the organization. Each member: - -- Joins automatically after accepting the invitation and creating their account -- Has a role for each product, such as CRE, ACE, or CRE Connect -- Can link their own wallet addresses to the organization -- Can deploy and manage their own workflows, depending on their roles -- Views product resources, such as CRE workflows, when their role for that product includes view access +Members are users invited to join the organization. A member joins automatically after accepting the invitation and creating their account. Each member has a role for each product, such as CRE, ACE, or CRE Connect, and can do only what those roles allow. ### Shared visibility @@ -69,7 +63,11 @@ The Owner role includes every permission for every product. See [RBAC](/chainlin ## API keys -Organizations can create API keys for programmatic access to products, such as the CRE CLI and the ACE APIs. A single API key can include permissions for multiple products. See [API Keys](/chainlink-platform/api-keys) to learn how to create and manage API keys. +Organizations can create API keys for programmatic access to products, such as the CRE CLI and the ACE APIs. A single API key can include permissions for multiple products. + + + See [API Keys](/chainlink-platform/api-keys) to learn how to create and manage API keys. + ## Learn more diff --git a/src/content/data-streams/llms-full.txt b/src/content/data-streams/llms-full.txt index 3de682e6815..16ce7c23676 100644 --- a/src/content/data-streams/llms-full.txt +++ b/src/content/data-streams/llms-full.txt @@ -5863,6 +5863,8 @@ The Settlement Verifier is a community tool on [data.chain.link](https://data.ch It was designed and shipped for prediction markets, which can link to it so their users can independently check the price a market settled on. +![The Settlement Verifier modal showing a BTC / USDT mid price, bid and ask prices, and the Valid From and Observed At timestamps](/images/data-streams/settlement-verifier/settlement-verifier.png) + ## Who it's for - **Traders and community members** who want to confirm the price used to settle a market without reading raw report data or writing code. @@ -5874,10 +5876,10 @@ It was designed and shipped for prediction markets, which can link to it so thei The Settlement Verifier answers a different question for a different audience: *"What price did Chainlink report at this boundary?"* It gives non-technical users a way to look up and read the report that settled a market. Builders who need cryptographic guarantees in their own contracts should still verify reports onchain. - +> **NOTE: Informational tool** +> +> The Settlement Verifier displays the data from a report. It does not perform signature verification in your browser, +> and it does not decide how any market resolves. Each market defines its own resolution rules. ## Supported streams From 8fb84b9212b7be782c95b5bd11e364aead6c0a44 Mon Sep 17 00:00:00 2001 From: devin distefano Date: Mon, 26 Oct 2026 21:20:14 -0500 Subject: [PATCH 2/3] updates --- .../ace/getting-started/account-setup.mdx | 48 ++-- src/content/ace/llms-full.txt | 46 ++-- src/content/chainlink-platform/api-keys.mdx | 219 ++++++++-------- src/content/chainlink-platform/rbac.mdx | 246 +++++++++--------- .../activating-pausing-workflows.mdx | 3 +- .../guides/operations/deleting-workflows.mdx | 3 +- .../deploying-to-onchain-registry-go.mdx | 3 +- .../deploying-to-onchain-registry-ts.mdx | 3 +- .../deploying-to-private-registry-go.mdx | 3 +- .../deploying-to-private-registry-ts.mdx | 3 +- .../secrets/using-secrets-deployed.mdx | 3 +- src/content/cre/llms-full-go.txt | 72 +++-- src/content/cre/llms-full-ts.txt | 72 +++-- .../cre/reference/cli/authentication.mdx | 30 +-- .../reference/graphql-api/authentication.mdx | 33 +-- .../crec/getting-started/prerequisites.mdx | 46 ++-- src/content/crec/llms-full.txt | 44 ++-- src/content/data-streams/llms-full.txt | 9 +- src/content/data-streams/sign-up.mdx | 11 +- 19 files changed, 424 insertions(+), 473 deletions(-) diff --git a/src/content/ace/getting-started/account-setup.mdx b/src/content/ace/getting-started/account-setup.mdx index 4d7e0ef314c..f56b32580bf 100644 --- a/src/content/ace/getting-started/account-setup.mdx +++ b/src/content/ace/getting-started/account-setup.mdx @@ -5,7 +5,7 @@ date: Last Modified metadata: description: "Set up your Chainlink ACE account: create an organization on app.chain.link, get your API key, create CRE Connect Wallets, and prepare for your first ACE deployment." datePublished: "2026-03-31" - lastModified: "2026-10-20" + lastModified: "2026-10-26" --- import { Aside, ClickToZoom, MethodTabs } from "@components" @@ -51,35 +51,29 @@ Share your Organization ID with your Chainlink contact so they can enable the AC Once your account has been provisioned for the ACE service, create an API key. -