Test DriveTCO CalculatorBook Demo

Permission model (read, create, *)

VMease WebUI uses a permission model to control what each administrator can see and do. Permissions are action-based and follow a structured naming pattern.

Back to documentation

Permission model (read, create, *)

Permission Format

  1. accesscontrol.users.read
  2. compute.vms.create
  3. networking.firewalls.*

Core Action Levels

  1. read: View/list/detail access only. No create, update, or delete actions
  2. create: Write-level access for create/modify flows. In WebUI behavior, this generally implies the user can also view (read) that module
  3. *: Full administrative control for the module. Includes all supported operations (view, create, update, delete, and related admin actions)

How the Model Is Applied

  1. Permissions are evaluated when routes are loaded and when UI controls are rendered.
  2. The same module can expose different UI actions based on action level: read (tables/details visible, write buttons hidden), create (create/edit flows enabled), * (full management actions enabled including delete/admin operations)

Practical Example

  1. accesscontrol.users.read → user can view users
  2. accesscontrol.users.create → user can add/edit users (and typically view)
  3. accesscontrol.users.* → user can fully manage users, including destructive actions where available
  1. Assign the lowest action level required for a role's job function.
  2. Use read for observer/reporting roles.
  3. Use create for operational roles that perform changes.
  4. Reserve * for trusted admin roles with full ownership of that module.

Ready to rethink private cloud?

Lower costs. Simplify operations. Deliver more.