Skip to content

Platform: implement feedback and better descriptions for permissions+roles #4363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dev-dist merged 6 commits into from
Oct 27, 2026
Merged

Platform: implement feedback and better descriptions for permissions+roles #4363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8179c98
implement feedback and better descriptions for rbac roles and permiss…
dev-dist Oct 27, 2026
8fb84b9
updates
dev-dist Oct 27, 2026
27f3937
Merge branch 'main' into rbac-ff
dev-dist Oct 27, 2026
090dab7
updates
dev-dist Oct 27, 2026
c8ac9f2
Merge branch 'rbac-ff' of github.com:smartcontractkit/documentation i…
dev-dist Oct 27, 2026
8329737
Merge branch 'main' into rbac-ff
robin-rrt Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 21 additions & 27 deletions src/content/ace/getting-started/account-setup.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ date: Last Modified
metadata:
description: "Set up your Chainlink ACE account: create an organization on app.chain.link, get your API key, create CRE Connect Wallets, and prepare for your first ACE deployment."
datePublished: "2026-03-31"
lastModified: "2026-10-20"
lastModified: "2026-10-26"
---

import { Aside, ClickToZoom, MethodTabs } from "@components"
Expand Down Expand Up @@ -51,35 +51,29 @@ Share your Organization ID with your Chainlink contact so they can enable the AC

Once your account has been provisioned for the ACE service, create an API key.

<Aside type="note" title="To create an API key for ACE">
- You must be the organization **Owner**

**OR**

- Have the ACE **Admin** or **Operator** role.

For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=ace#ace). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=ace).

{/* prettier-ignore */}
<Aside type="note" title="Roles needed to create a ACE API key">
Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant every permission below you also need the ACE Admin role. ACE Operators can grant every permission below except `ace:core:wallet:write`. See [RBAC](/chainlink-platform/rbac?parent=ace#ace) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=ace) to invite members and assign roles.
</Aside>

1. Log in to the [Chainlink Platform](https://app.chain.link), click on "Org settings" in the top-right corner of the navbar to open your **Organization Settings** page, then open the **API Keys** tab.
1. Log in to the [Chainlink Platform](https://app.chain.link), click your account icon in the top-right corner of the navbar, then click **Org settings** to open the **Organization** page, then open the **API Keys** tab.
1. Click **Create API Key** and enter a name for the key.
1. In the **API Scope** section, expand the **ACE** accordion and grant the key the permissions that this Getting Started guide uses.

| Name | Action | Permission ID |
| ---------------------------- | ------ | ---------------------------------------- |
| Core wallet | Write | `ace:core:wallet:write` |
| Policy manager policy engine | Write | `ace:policy_manager:policy_engine:write` |
| Policy manager target | Write | `ace:policy_manager:target:write` |
| Policy manager policy | Write | `ace:policy_manager:policy:write` |
| Identity manager registry | Write | `ace:identity_manager:registry:write` |
| Identity manager identity | Write | `ace:identity_manager:identity:write` |
| Reporting policy | Read | `ace:reporting:policy:read` |
| Reporting identity | Read | `ace:reporting:identity:read` |
| Reporting target | Read | `ace:reporting:target:read` |
| Reporting transaction | Read | `ace:reporting:transaction:read` |
| Reporting permit | Read | `ace:reporting:permit:read` |
| Reporting registry | Read | `ace:reporting:registry:read` |
1. In the **API Scope** section, expand the **ACE** section and grant the key the permissions that this Getting Started guide uses.

| Name | Permission | Description |
| ----------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------ |
| Core wallet: Write | `ace:core:wallet:write` | Create wallet. |
| Policy manager policy engine: Write | `ace:policy_manager:policy_engine:write` | Create and update policy engine. |
| Policy manager target: Write | `ace:policy_manager:target:write` | Create and update target and its protections. |
| Policy manager policy: Write | `ace:policy_manager:policy:write` | Create and update policy and data validator instances. |
| Identity manager registry: Write | `ace:identity_manager:registry:write` | Create and update identity or credential registry, and credential types. |
| Identity manager identity: Write | `ace:identity_manager:identity:write` | Create and update identity, and assign credentials. |
| Reporting policy: Read | `ace:reporting:policy:read` | Read the reporting service's policy view. |
| Reporting identity: Read | `ace:reporting:identity:read` | Read the reporting service's identity view. |
| Reporting target: Read | `ace:reporting:target:read` | Read the reporting service's target view. |
| Reporting transaction: Read | `ace:reporting:transaction:read` | Read the reporting service's transaction view. |
| Reporting permit: Read | `ace:reporting:permit:read` | Read the reporting service's permit view. |
| Reporting registry: Read | `ace:reporting:registry:read` | Read the reporting service's registry usage view. |

See [API Keys](/chainlink-platform/api-keys?parent=ace#ace) for the full list of permissions available for ACE.

Expand Down
46 changes: 20 additions & 26 deletions src/content/ace/llms-full.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1824,7 +1824,7 @@ Before diving in, these pages provide essential context:

# Account Setup
Source: https://docs.chain.link/ace/getting-started/account-setup
Last Updated: 2026-10-20
Last Updated: 2026-10-26

> **NOTE: Private Beta**
>
Expand Down Expand Up @@ -1863,36 +1863,30 @@ Share your Organization ID with your Chainlink contact so they can enable the AC

Once your account has been provisioned for the ACE service, create an API key.

> **NOTE: To create an API key for ACE**
> **NOTE: Roles needed to create a ACE API key**
>
> - You must be the organization **Owner**
>
> **OR**
>
> - Have the ACE **Admin** or **Operator** role.
>
> For information about role-based access, see [RBAC](/chainlink-platform/rbac?parent=ace#ace). To invite team members and assign roles, see [Invite members](/chainlink-platform/inviting-team-members?parent=ace).
> Creating an API key requires a Platform role that includes API key permissions: Platform User, Platform Admin, or Owner. You can only give a key permissions that your own roles include, so to grant every permission below you also need the ACE Admin role. ACE Operators can grant every permission below except `ace:core:wallet:write`. See [RBAC](/chainlink-platform/rbac?parent=ace#ace) for what each role includes, and [Inviting Team Members](/chainlink-platform/inviting-team-members?parent=ace) to invite members and assign roles.

1. Log in to the [Chainlink Platform](https://app.chain.link), click on "Org settings" in the top-right corner of the navbar to open your **Organization Settings** page, then open the **API Keys** tab.
1. Log in to the [Chainlink Platform](https://app.chain.link), click your account icon in the top-right corner of the navbar, then click **Org settings** to open the **Organization** page, then open the **API Keys** tab.

2. Click **Create API Key** and enter a name for the key.

3. In the **API Scope** section, expand the **ACE** accordion and grant the key the permissions that this Getting Started guide uses.

| Name | Action | Permission ID |
| ---------------------------- | ------ | ---------------------------------------- |
| Core wallet | Write | `ace:core:wallet:write` |
| Policy manager policy engine | Write | `ace:policy_manager:policy_engine:write` |
| Policy manager target | Write | `ace:policy_manager:target:write` |
| Policy manager policy | Write | `ace:policy_manager:policy:write` |
| Identity manager registry | Write | `ace:identity_manager:registry:write` |
| Identity manager identity | Write | `ace:identity_manager:identity:write` |
| Reporting policy | Read | `ace:reporting:policy:read` |
| Reporting identity | Read | `ace:reporting:identity:read` |
| Reporting target | Read | `ace:reporting:target:read` |
| Reporting transaction | Read | `ace:reporting:transaction:read` |
| Reporting permit | Read | `ace:reporting:permit:read` |
| Reporting registry | Read | `ace:reporting:registry:read` |
3. In the **API Scope** section, expand the **ACE** section and grant the key the permissions that this Getting Started guide uses.

| Name | Permission | Description |
| ----------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------ |
| Core wallet: Write | `ace:core:wallet:write` | Create wallet. |
| Policy manager policy engine: Write | `ace:policy_manager:policy_engine:write` | Create and update policy engine. |
| Policy manager target: Write | `ace:policy_manager:target:write` | Create and update target and its protections. |
| Policy manager policy: Write | `ace:policy_manager:policy:write` | Create and update policy and data validator instances. |
| Identity manager registry: Write | `ace:identity_manager:registry:write` | Create and update identity or credential registry, and credential types. |
| Identity manager identity: Write | `ace:identity_manager:identity:write` | Create and update identity, and assign credentials. |
| Reporting policy: Read | `ace:reporting:policy:read` | Read the reporting service's policy view. |
| Reporting identity: Read | `ace:reporting:identity:read` | Read the reporting service's identity view. |
| Reporting target: Read | `ace:reporting:target:read` | Read the reporting service's target view. |
| Reporting transaction: Read | `ace:reporting:transaction:read` | Read the reporting service's transaction view. |
| Reporting permit: Read | `ace:reporting:permit:read` | Read the reporting service's permit view. |
| Reporting registry: Read | `ace:reporting:registry:read` | Read the reporting service's registry usage view. |

See [API Keys](/chainlink-platform/api-keys?parent=ace#ace) for the full list of permissions available for ACE.

Expand Down
Loading
Loading