Staff role and permission matrix

Derived from admin/src/admin/roles.ts. Route-specific overrides still apply: see each operation and the API specification notes. “Step-up” means password plus TOTP within ten minutes. “Reason” means a written, URI-encoded X-Admin-Reason of 3–300 characters.

Permission	Owner	Support	Billing	Read-only	Step-up default	Reason default
`overview.read`	Yes	Yes	Yes	Yes	—	—
`accounts.search`	Yes	Yes	Yes	Yes	—	—
`accounts.read`	Yes	Yes	Yes	Yes	—	—
`accounts.content.read`	Yes	Yes	—	—	Yes	Yes
`accounts.update`	Yes	Yes	—	—	Yes	—
`accounts.disable`	Yes	Yes	—	—	Yes	—
`accounts.signout`	Yes	Yes	—	—	Yes	—
`accounts.mfa_reset`	Yes	—	—	—	Yes	—
`accounts.delete`	Yes	—	—	—	Yes	Yes
`accounts.restore`	Yes	Yes	—	—	Yes	Yes
`accounts.purge_now`	Yes	—	—	—	Yes	Yes
`cloud.read`	Yes	Yes	—	Yes	—	Yes
`keys.revoke`	Yes	Yes	—	—	Yes	Yes
`orgs.api_access`	Yes	Yes	—	—	Yes	Yes
`icloud.read`	Yes	Yes	—	—	—	—
`billing.read`	Yes	Yes	Yes	Yes	—	Yes
`usage.read`	Yes	Yes	Yes	Yes	—	—
`support.read`	Yes	Yes	Yes	Yes	—	—
`support.reply`	Yes	Yes	Yes	—	—	—
`support.assign`	Yes	Yes	Yes	—	—	—
`support.manage`	Yes	Yes	—	—	—	—
`schools.read`	Yes	Yes	Yes	Yes	—	—
`schools.approve`	Yes	Yes	—	—	Yes	—
`schools.manage`	Yes	Yes	—	—	—	—
`schools.close`	Yes	—	—	—	Yes	Yes
`config.read`	Yes	Yes	Yes	Yes	—	—
`config.write`	Yes	—	—	—	Yes	—
`hooks.manage`	Yes	—	—	—	Yes	—
`audit.read`	Yes	Yes	Yes	Yes	—	—
`admins.read`	Yes	Yes	Yes	Yes	—	—
`admins.create`	Yes	—	—	—	Yes	—
`admins.role`	Yes	—	—	—	Yes	—
`admins.disable`	Yes	—	—	—	Yes	—
`admins.sessions`	Yes	—	—	—	Yes	—
`alarms.read`	Yes	Yes	Yes	Yes	—	—

Conditional rules

The job recompute handler checks owner and step-up in addition to overview.read.

schools.manage needs step-up on its PATCH route even though the permission default does not.

Listing staff hooks explicitly skips step-up; modifying/testing hooks requires it.

Cloud metadata uses a target-specific reason marker; content=1 adds accounts.content.read and step-up.

Platform billing aggregates skip reason; account billing uses a target-specific 15-minute reason marker.

Own sessions can be listed/revoked by admitted staff; other staff sessions have additional owner permission and, for revocation, step-up.

Staff role/status changes cannot remove the last active owner. Self role changes and self-disable are refused; password reset cannot target yourself.

Server-side permission gates are authoritative; hiding a navigation item alone is not access control.

Staff role and permission matrix

Conditional rules#

Conditional rules