Skip to content

Permissions List

TrueWatch supports setting permissions for custom roles within a Workspace to meet the permission requirements of different users.

Note

Currently, only permissions for feature operations within the Workspace are supported.

Permissions List

  • √: For default roles, this indicates that the permission is supported; for custom roles, this indicates that the permission can be granted to the custom role.
  • ×: For default roles, this indicates that the permission is not supported; for custom roles, this indicates that the permission cannot be granted to the custom role.

Agent Monitoring supports two types of ingestion: Agent and LLM. Configuration operations such as evaluator management, evaluation execution, annotation queue and dataset management, and manual annotation all fall under the Agent Monitoring > Application Configuration Management permission in the table below. Viewing data such as Trace remains subject to the corresponding data query permissions.

Permission items marked as "Legacy" remain listed in the main table because the current front-end console still retains the corresponding configuration. The legacy Service List and Incident Issue features do not indicate that upgraded Workspaces still provide the corresponding entries. For the new versions, refer to the Unified Catalog and Incident Center respectively.

Features
Operational Permissions
 Owner Administrator Standard Read-only Custom Role
General Default Access √ √ √ √ √
Explorer > Global Configuration Management √ √ × × √
Export Management √ √ √ × √
Workspace Management API Key Management √ √ × × √
Manage Members' Use of Personal API Keys √ √ × × √
View Token √ √ × × √
Rotate Token √ √ × × ×
Client Token Management √ √ √ × √
View Member Management √ √ √ × √
Invite Members √ √ √ × √
Member Management √ √ × × √
Transfer Ownership √ × × × ×
Settings Management √ √ × × √
Disband Workspace √ × × × ×
Data Storage Policy Management √ × × × ×
Workspace Status Management √ × × × ×
Data Permission Management Configuration Management √ √ × × √
Sensitive Data Scanning Configuration Management √ √ × × √
Field Management Field Configuration Management √ √ √ × √
Regular Expressions Regular Expression Configuration Management √ √ × × √
Cloud Account Management Account Management √ √ × × ×
Integration Configuration Management √ √ × × √
Global Tags Global Tag Configuration Management √ √ × × √
Share Management Share Configuration Management √ √ √ × √
Labs Lab Feature Configuration Management √ √ × × √
Snapshots Create Snapshot √ √ √ √ √
Delete Snapshot √ √ √ × √
Plans & Billing Plans & Billing Read-Only Permission √ √ × × √
Plans & Billing Read/Write Permission √ × × × ×
Upgrade Permission √ × × × ×
Scenarios View Dashboards & Views √ √ √ √ √
Create Dashboard √ √ √ × √
Manage Dashboards √ √ √ × √
Tag Permission Management √ √ × × √
View Management √ √ √ × √
Notes & Explorer Management √ √ √ × √
Chart Configuration Management √ √ √ × √
Service List Management (Legacy) √ √ √ × √
View Scheduled Reports √ √ √ × √
Manage Scheduled Reports √ √ √ × √
Events Manual Recovery √ √ √ × √
Event Data Query √ √ √ √ √
Infrastructure Infrastructure Configuration Management √ √ × × √
Infrastructure Data Query √ √ √ √ √
Logs Log Index Management √ √ × × √
External Index Management √ √ × × √
Data Forwarding Management √ √ × × √
Log Data Query √ √ √ √ √
Metrics Metric Description Management √ √ √ × √
Metric Data Query √ √ √ √ √
Application Performance Monitoring (APM) Log Correlation Management √ √ √ × √
APM Data Query √ √ √ √ √
Issue Auto-Discovery (Legacy) √ √ √ × √
Service Management (Legacy Service List) √ √ × × √
Real User Monitoring (RUM) Application Configuration Management √ √ √ × √
Tracking Configuration Management √ √ √ × √
RUM Data Query √ √ √ √ √
View Session Replay √ √ √ √ √
Issue Auto-Discovery (Legacy) √ √ √ × √
Agent Monitoring Application Configuration Management √ √ √ × √
Agent Monitoring Data Query √ √ √ √ √
Synthetic Monitoring Task Configuration Management √ √ √ × √
Self-hosted Node Configuration Management √ √ √ × √
Monitoring View Monitors √ √ √ √ √
Monitor Configuration Management √ √ √ × √
External Event Reporting Management √ √ × × √
Intelligent Inspection Configuration Management √ √ √ × √
SLO Configuration Management √ √ √ × √
Mute Configuration Management √ √ √ × √
Alert Policy Configuration Management √ √ √ × √
Notification Target Configuration Management √ √ × × √
Incident (Legacy) Channel Management √ √ √ × √
Channel Subscription √ √ √ √ √
View Channels √ √ √ √ √
Issue Management √ √ √ × √
View Issues √ √ √ √ √
Reply Management √ √ √ × √
View Replies √ √ √ √ √
Severity Configuration √ √ × × √
Notification Policy √ √ √ × √
Schedule √ √ √ × √
Issue Discovery (Legacy) √ √ √ × √
Pipelines Pipelines Management √ √ √ × √
Blacklist Create & Edit Blacklist √ √ √ × √
Enable & Disable Blacklist √ √ √ × √
Delete Blacklist √ √ √ × √
Generate Metrics Generate Metrics Configuration Management √ √ √ × √
DCA DCA Configuration Management √ √ × × ×
DataFlux Func (Automata) Provision/Configure Func √ × × × ×
Managed RUM Provision/Configure RUM √ × × × ×
RUM Administrator √ √ × × ×
Cloud Billing Cloud Billing Data Query √ √ √ √ √
External Data Sources Data Source Configuration Management √ √ × × √
Data Source Query Permission √ √ √ √ √
Environment Variables Environment Variable Configuration Management √ √ × × √
Operation Audit View Operation Audit √ √ √ √ √
Ticket Management Ticket Management Configuration √ √ × × √
Security Monitoring CSPM Configuration Management √ √ √ × √
SIEM Configuration Management √ √ √ × √
Incident Center View Incidents √ √ √ √ √
Manage Incidents √ √ √ × √
Incident Collaboration √ √ √ × √
Incident Severity Management √ √ × × √
On-Call Management √ √ √ × √
Error Center View Errors √ √ √ √ √
Manage Errors √ √ √ × √
Error Collaboration √ √ √ × √
Error Delivery Rule Management √ √ × × √
View Error Delivery Rules √ √ √ × √
Unified Catalog Entity Category Configuration √ √ √ × √
Entity Configuration √ √ √ × √
View Entities √ √ √ √ √

Permission Descriptions

Contains specific descriptions for each permission item in the permissions list.

Features
Operational Permissions
 Description
General Default Access The view and operation permissions that users have by default after entering the Workspace, including the following permission scopes
Explorer > Global Configuration Management
  • Management of default-displayed quick filters and accelerated fields at the Workspace level
  • Log Explorer formatting configuration management
    		•
    Export Management Management of data export permissions within the Workspace, including the following scopes:
  • Explorer: export CSV files, copy as cURL
  • Metrics Management: export CSV files
  • Event details page: export JSON, PDF
    		•
    Workspace Management API Key Management Operations such as creating, viewing, and deleting API Keys
    Manage Members' Use of Personal API Keys Enable or disable members' eligibility to use personal API Keys in the current Workspace. This permission does not provide management of personal API Key plaintext, secret content, or credential lifecycle
    View Token Obtain the Workspace Token
    Rotate Token Rotate the Workspace Token. Having this permission requires also having the "View Token" permission
    Client Token Management Create and delete Client Tokens
    View Member Management Includes read-only view permission for the following pages:
  • Member Management and member detail pages
  • SSO Management and SAML mapping
    		•
    Invite Members
    Member Management Operations related to Workspace member management and SSO management, including:
  • Member group management (add, delete, modify)
  • Member information management (delete, modify)
  • Role management (create, delete, modify)
  • Invitation records
  • Batch permission changes
  • SSO management
       - SSO login (enable, disable, delete)
       - SAML mapping (create, delete, modify, enable, disable)
       - Custom mapping (create, delete, modify)
    		•
    Transfer Ownership Transfer the current Workspace Owner to another member
    Settings Management Editing operations on the Workspace Settings page, including the following permission scopes
    Disband Workspace Disband the Workspace, including operations such as unbinding the Commercial Plan Workspace from the Billing Center account and deleting the Workspace.
  • Disband entry when the Workspace is in a locked state
    		•
    Data Storage Policy Management
  • Modify Measurement storage policies (Metrics Management page)
  • Modify general storage policies (Management > Settings page)
    		•
    Workspace Status Management Includes certain operations when the Workspace is in a locked state.
  • Go to the Billing Center to resolve billing issues
    		•
    Data Permission Management Configuration Management
  • Sensitive fields: disable, enable, configure (add, delete)
  • Data authorization: configure (add, delete)
  • Data access rules: add or remove rules associated with roles in Role Management
    		•
    Sensitive Data Scanning Configuration Management Create, edit, enable, disable, delete
    Field Management Field Configuration Management Create, edit, delete
    Regular Expressions Regular Expression Configuration Management Create, edit, clone, delete
    Cloud Account Management Account Management Create, edit, delete
    Integration Configuration Management Install, uninstall, and modify configuration
    Global Tags Global Tag Configuration Management Create, edit, delete
    Share Management Share Configuration Management Share charts, unshare charts, share snapshots, unshare snapshots
    Labs Lab Feature Configuration Management Enable or disable the Lab features of the current Workspace
    Snapshots Create Snapshot Create snapshots, including:
  • Scenarios: Dashboards, Notes, Explorers
  • Events: Unrecovered Events, Events
  • Infrastructure: Host, Containers, Process, Network, Custom
  • Logs: All Logs, Pattern
  • APM: Services, Overview, Traces, Error Tracking, Profile
  • RUM: Views, Explorers, Traces
  • Synthetic Monitoring: Overview, Explorers
  • CI Visualization: Overview, Explorers
    		•
    Delete Snapshot Delete snapshots (read-only members can only delete snapshots created by their own account), including:
  • Scenarios: Dashboards, Notes, Explorers
  • Events: Unrecovered Events, Events
  • Infrastructure: Host, Containers, Process, Network, Custom
  • Logs: All Logs, Pattern
  • APM: Services, Overview, Traces, Error Tracking, Profile
  • RUM: Views, Explorers, Traces
  • Synthetic Monitoring: Overview, Explorers
  • CI Visualization: Overview, Explorers
    		•
    Plans & Billing Plans & Billing Read-Only Permission
  • View current Workspace usage statistics and billing charges
  • Set high-spending alerts
    		•
    Plans & Billing Read/Write Permission Includes viewing the account balance, recharging, changing payment methods, changing the Billing Center account, and navigating to the Billing Center. Only members with the Owner role of the current Workspace can view and initiate these operations
    Scenarios View Dashboards & Views Includes visibility of the Dashboards and Views modules, querying Dashboards and Views (viewing the Dashboard list page and detail pages), setting the refresh frequency, and changing the query time range; view permission for carousels
    Create Dashboard Create Dashboards. The front end also allows roles with the "Manage Dashboards" permission to enter the creation flow
    Manage Dashboards
  • Dashboards: create, delete, modify (with this permission, Explorers support exporting list data to Dashboards), import, export, duplicate, save to Built-in Views
  • Carousels: create, modify, delete
    		•
    Tag Permission Management Management of Dashboard tag permissions: create, edit, and delete tags
    View Management
  • Built-in Views > System Views: export, clone
  • Built-in Views > User Views: create, delete, modify, export, clone
    		•
    Notes & Explorer Management
  • Notes: create, delete, modify (with this permission, Explorers support exporting list data to Notes), import, export (JSON/PDF)
  • Explorers: create, delete, modify, export, import, duplicate, add to menu
    		•
    Chart Configuration Management This permission was previously removed and has now been restored. Includes:
  • View variables: add, edit, delete
  • Charts: add, modify, combine, clone, delete
  • Chart groups: add, modify, delete
    		•
    Service List Management (Legacy) Edit legacy Service List configuration. This permission item is still retained in the front-end console and therefore remains in the main table. For service assets in the new version, see the Unified Catalog
    View Scheduled Reports View
    Manage Scheduled Reports Create, edit, delete, enable/disable
    Events Manual Recovery Includes manual recovery operations for Unrecovered Events
    Event Data Query Query all event data in the Workspace, including all data for Events and Unrecovered Events
    Infrastructure Infrastructure Configuration Management Includes operations such as editing Host labels, editing object categories, adding object categories, adding tags, and deleting objects
    Infrastructure Data Query Query all infrastructure object data in the Workspace, including Host, Containers, K8s, Process, and Resource Catalog data, historical data from the past 48 hours, and Layer 4 and Layer 7 network data reported to the Workspace
    Logs Log Index Management Read/write permission. Includes create, delete, modify, enable, disable, and drag-and-drop operations
    External Index Management Read/write permission. Includes bind and delete operations
    Data Forwarding Management Read/write permission. Includes create, edit, delete, enable, and disable operations
    Log Data Query Query all log data in the current Workspace, including TrueWatch Log (L) default indexes, custom indexes, bound external index (ES, Opensearch, SLS standard logstore) data, and backup log (BL) data
    Metrics Metric Description Management Edit and modify metric descriptions
    Metric Data Query Query all metric data in the current Workspace
    APM Log Correlation Management Edit log correlation field configuration
    APM Data Query Query all Trace and Profile data in the current Workspace
    Issue Auto-Discovery (Legacy) Legacy Incident Issue auto-discovery: aggregates error tracking data by service, version, resource, and error type. The front-end console still retains this permission item
    Service Management (Legacy Service List) Legacy Service List management and service custom filter field configuration. The front-end console still retains this permission item
    RUM Application Configuration Management Create, modify, delete applications
    Tracking Configuration Management Create, modify, delete tracking configurations
    RUM Data Query Query all RUM data in the current Workspace, including session, session replay, view, resource, error, long task, and action data
    View Session Replay View permission for all Session Replay data in the current Workspace
    Issue Auto-Discovery (Legacy) Legacy Incident Issue auto-discovery: aggregates error data by application name, environment, version, and error type. The front-end console still retains this permission item
    Agent Monitoring Application Configuration Management Create, modify, and delete Agent or LLM monitoring applications; manage evaluators, annotation queues and datasets; execute evaluations and manual annotation
    Agent Monitoring Data Query Query Agent and LLM monitoring data in the current Workspace
    Synthetic Monitoring Task Configuration Management Create, delete, modify, enable, disable, and test
    Self-hosted Node Configuration Management Create, modify, delete, and obtain configuration
    Monitoring View Monitors View the Monitor list page and Monitor configuration detail pages
    Monitor Configuration Management Create, delete, test, modify, enable, disable, import, bulk export, bulk delete, edit alert configuration, and create from template
    External Event Reporting Management View the Webhook addresses generated by "External Event Detection" monitors
    Intelligent Inspection Configuration Management Create, delete, modify, enable, disable
    SLO Configuration Management Create, delete, modify, enable, disable
    Mute Configuration Management Create, delete, modify, enable, disable
  • Monitoring > Mute Management
  • Infrastructure > Host detail page > Mute Host
    		•
    Alert Policy Configuration Management Create, delete, and edit alert configuration
    Notification Target Configuration Management Create, delete, modify
    Incident (Legacy) Channel Management
  • Channels: create, modify, delete
  • Notification targets: add, modify
    		•
    Channel Subscription
    View Channels
    Issue Management Create, modify, and delete Issues; upload attachments
    View Issues
    Reply Management
    View Replies
    Severity Configuration
  • Default levels: enable, disable
  • Custom levels: create, edit, delete
    		•
    Notification Policy Create, modify, delete
    Schedule Create, modify, delete
    Issue Discovery (Legacy) Create, modify, delete, enable, and disable legacy Incident Issue discovery rules. The front-end console still retains this permission item
    Pipelines Pipelines Management Read/write permission. Includes create, modify, delete, enable, disable, import, bulk export, bulk delete, and clone from the official library
  • Logs > Pipelines
  • Management > Pipelines
    		•
    Blacklist Create & Edit Blacklist Includes create, modify, import, and export
  • Logs > Blacklist
  • Management > Blacklist
    		•
    Enable & Disable Blacklist Includes enable and disable
  • Logs > Blacklist
  • Management > Blacklist
    		•
    Delete Blacklist Permission to delete the Blacklist
  • Logs > Blacklist
  • Management > Blacklist
    		•
    Generate Metrics Generate Metrics Configuration Management Includes create, modify, delete, enable, and disable operations
  • Logs > Generate Metrics
  • APM > Generate Metrics
  • RUM > Generate Metrics
    		•
    DCA DCA Configuration Management
  • Restart DataKit; create, delete, and modify collectors, Pipelines, and Blacklists
  • Configure the DCA address
    		•
    DataFlux Func (Automata) Provision/Configure Func Activate the application, modify the domain/specifications, upgrade the version, reset the password, and deactivate the application
    Managed RUM Provision/Configure RUM Activate the application, modify the service address and specifications, upgrade the version, and deactivate the application
    RUM Administrator View configuration information; modify the service address, specifications, version, status, and configuration
    Cloud Billing Cloud Billing Data Query
    External Data Sources Data Source Configuration Management Create, edit, and delete operations
    Data Source Query Permission Query external data sources
    Environment Variables Environment Variable Configuration Management Create, import, export, edit, delete
    Operation Audit View Operation Audit Permission to view Operation Audit data
    Ticket Management Ticket Management Configuration Delete submitted tickets. The delete entry is located in the "More" menu at the top of the ticket details page
    Security Monitoring CSPM Configuration Management Create, delete, test, modify, enable, disable, import, bulk export, bulk delete, and edit alert configuration
    SIEM Configuration Management Create, delete, modify, enable, disable, import, bulk export, bulk delete, and edit alert configuration
    Incident Center View Incidents Permission to view Incidents
    Manage Incidents Change Incident severity, claim Incidents, comment, and upload attachments
    Incident Collaboration Comment on Incidents and upload attachments
    Incident Severity Management
  • Enable and disable default severities
  • Custom severities: create, edit, delete
    		•
    On-Call Management Create, modify, and delete on-call schedules
    Error Center View Errors View the error list, error details, error distribution, and related context information
    Manage Errors Change error status, claim errors, assign owners, comment, and upload attachments
    Error Collaboration Comment on errors and upload attachments
    Error Delivery Rule Management Create, modify, and delete error delivery rules
    View Error Delivery Rules View error delivery rules and their configuration scope
    Unified Catalog Entity Category Configuration Includes create, edit, and delete operations for entity categories, and editing associated views
    Entity Configuration Includes create, edit, and delete operations for entities
    View Entities View the entity list and view the Topology View

    Default Access

    • Dashboards, Notes, Explorers, Built-in Views: read-only permission
    • Dashboard carousels: read-only permission
    • Charts: read-only permission, copy
    • Dashboards, Notes, Explorers: favorites
    • All Explorers: read-only permission
    • Personal quick filters in all Explorers: edit permission
    • Display columns in all Explorers: configuration permission
    • Creators of Dashboards, Notes, and Explorers: edit permission
    • APM > Service List (Legacy): read-only permission
    • RUM > Application Configuration: read-only permission
    • RUM > Tracking Configuration: read-only permission
    • Synthetic Monitoring > Task Configuration: read-only permission
    • Synthetic Monitoring > Self-hosted Node Configuration: read-only permission
    • Monitors, Intelligent Inspection, SLO, Mute Management, Alert Policies, Notification Targets: read-only permission
    • Pipelines Configuration: read-only permission for user pipelines and official pipelines
    • Blacklist Configuration: read-only permission
    • Workspace basic information: read-only permission
    • Member Management: read-only permission
    • SSO Management: read-only permission
    • Role Management: read-only permission
    • Field Management: read-only permission
    • Data Permission Management: read-only permission
    • Regular Expressions: read-only permission
    • Share Management: read-only permission
    • Snapshots: read-only permission (view/copy)
    • DQL Query Tool
    • Integrations
    • Obs Assistant
    • Experience Demo Workspace
    • Ticket Management
    • Workspace remarks (personal account level)
    • Onboarding Guide
    • Auto-popup of the Onboarding Guide
    • Avatar > View Onboarding Guide
    • Log data access configuration view: read-only
    • Incident (Legacy): Channels read-only, Issues read-only, Replies read-only, Notification Policies read-only, Schedules read-only

    Settings Management

    • Modify the Workspace name
    • Modify the description
    • Configuration migration (import, export)
    • Advanced settings
    • Add and delete key metrics
    • Feature menu management
    • View Operation Audit
    • IP whitelist settings
    • Enable data access scope restriction
    • Set the daily Metrics reporting limit

    • Manual data deletion operations within the Workspace, including:

      • Delete data of a specific Measurement
      • Delete custom objects
      • A single custom object (custom object details page)
      • All custom objects (Management > Settings > Risky Operations)
      • Custom objects under a specific object category (Management > Settings > Risky Operations)
      • Enable approval-based joining