{"schemaVersion":"1","contentVersion":"2026-11-01.13","slug":"system-explorer-permissions","title":"Permissions","summary":"Control exactly who—or what—can access your application's resources.","category":"System Explorer","manual":true,"minutes":10,"prerequisites":[],"technical":[],"sources":["Live Rumata workspace reviewed October 15, 2026; controls inspected without modifying resources."],"related":["controls-access"],"sections":[{"id":"introduction","title":"About Permissions","blocks":[{"type":"paragraph","text":"Rumata provides a powerful, **granular permission system** that gives you control over access at multiple levels, from projects and factories down to individual resources and their permitted actions."},{"type":"paragraph","text":"Instead of giving everyone full access to your application, you can decide exactly what each person, team, or workflow is allowed to do."},{"type":"paragraph","text":"For example, you can allow a teammate to view a database without modifying its records, give another team permission to manage specific workflows, or authorize an automated workflow to access only the resources it needs."},{"type":"paragraph","text":"All of this is managed directly within Rumata, keeping collaboration and resource security in one place."}]},{"id":"before-you-start","title":"Before you start","blocks":[{"type":"paragraph","text":"Open your factory workspace and navigate to **System Explorer → Access → Permissions**."},{"type":"paragraph","text":"Rumata organizes access through **Groups**, which help you manage permissions for people and other authorized resources."},{"type":"paragraph","text":"You'll also find **Manage access** controls throughout System Explorer, allowing you to configure permissions for individual resources."}]},{"id":"open","title":"1. Understand how Rumata permissions work","blocks":[{"type":"paragraph","text":"Rumata's permission system is designed to give you detailed control over your software."},{"type":"paragraph","text":"Rather than granting broad access to an entire application, you can manage permissions for specific resources and the actions available on them."},{"type":"heading","text":"What can you control?"},{"type":"paragraph","text":"Depending on the resource, permissions can cover areas such as:"},{"type":"list","items":["**Databases:** Control access to specific database resources and their available operations.","**Workflows:** Decide who can view, modify, execute, or manage particular workflows.","**Activities:** Control which groups can use reusable operations.","**Storage:** Manage access to specific buckets and stored resources.","**Keys & Secrets:** Restrict which authorized resources can use sensitive credentials.","**Services:** Control access to backend resources and their available management operations."]},{"type":"paragraph","text":"Available permissions vary by resource type."},{"type":"heading","text":"Permissions for people and workflows"},{"type":"paragraph","text":"Rumata's permission system isn't limited to human users."},{"type":"paragraph","text":"**People and teams** can receive permissions based on their responsibilities, allowing different collaborators to work on the same application without needing unrestricted access."},{"type":"paragraph","text":"**Workflows** can also be granted permissions, allowing automations to access authorized resources as they execute."},{"type":"paragraph","text":"For example, a workflow that processes customer orders might need permission to access customer records and update order information, but it doesn't need unrestricted access to every database or storage resource."},{"type":"paragraph","text":"This allows you to build automated processes while keeping their access limited to what they actually need."},{"type":"note","title":"Good to know","text":"Permissions apply to the specific resources and actions you've authorized. Access to one resource doesn't automatically grant access to unrelated resources."}]},{"id":"create","title":"2. Create and manage groups","blocks":[{"type":"paragraph","text":"**Groups** make it easier to manage access for multiple collaborators without configuring permissions for every person individually."},{"type":"paragraph","text":"For example, you could create separate groups for developers, designers, and operations teams, each with different levels of access."},{"type":"heading","text":"Create a group"},{"type":"steps","items":["Open **System Explorer → Access → Permissions**.","Select **Groups**.","Click **New**.","Enter a descriptive **Name** and an optional **Description**.","Click **Create group**.","Open the new group to manage its members and permissions."]},{"type":"heading","text":"Find an existing group"},{"type":"steps","items":["Open **Groups**.","Use **Search groups** to find the group you need.","Select the group to review its members and available invitation controls."]},{"type":"note","title":"Important","text":"Creating a group doesn't automatically grant access to your factory's resources."},{"type":"paragraph","text":"You must separately assign the permissions the group needs."}]},{"id":"invite","title":"3. Invite teammates to collaborate","blocks":[{"type":"paragraph","text":"You can invite other Rumata users to join groups and collaborate on your application."},{"type":"heading","text":"Invite a teammate"},{"type":"steps","items":["Open **Permissions → Groups**.","Select the group you want the teammate to join.","Enter their exact Rumata nickname in **Invite by nickname**.","Click **Invite**.","Ask your teammate to sign in to their Rumata account and open **Invitations**.","They can review the invitation and select **Accept** or **Decline**."]},{"type":"paragraph","text":"Once the invitation is accepted, the teammate becomes a member of the group."},{"type":"heading","text":"Check your result"},{"type":"paragraph","text":"Confirm that the teammate appears in the group and can access the intended resources."},{"type":"note","title":"Good to know","text":"Group membership and resource access are separate. A user must belong to the appropriate group, and that group must have the required resource permissions."},{"type":"paragraph","text":"An invitation doesn't activate a Rumata subscription."}]},{"id":"resource","title":"4. Grant access to individual resources","blocks":[{"type":"paragraph","text":"One of Rumata's key advantages is the ability to manage permissions at a granular level."},{"type":"paragraph","text":"You don't have to give someone access to an entire application just because they need to work with one component."},{"type":"paragraph","text":"For example, you might allow a teammate to inspect a database while preventing them from changing it, or grant access to one workflow without sharing every workflow in the factory."},{"type":"heading","text":"Configure resource permissions"},{"type":"steps","items":["Open the resource you want to manage in **System Explorer**.","Select its **Manage access** control.","Choose the group you want to authorize.","Review the available permissions for that resource.","Select the actions the group should be allowed to perform.","Save your changes.","Verify the permissions using the intended collaborator's account."]},{"type":"heading","text":"Example"},{"type":"paragraph","text":"Imagine your application has a customer database and several workflows."},{"type":"paragraph","text":"You might configure access so that:"},{"type":"list","items":["**Developers** can inspect and modify the resources they maintain.","**Support staff** can access the customer information required for their work.","**Operations managers** can review workflow activity without modifying unrelated resources."]},{"type":"paragraph","text":"Each group receives only the permissions necessary for its responsibilities."},{"type":"note","title":"Important","text":"Permission options depend on the resource. Always review the actual available actions before granting access."}]},{"id":"workflow-access","title":"5. Give workflows permission to access resources","blocks":[{"type":"paragraph","text":"In Rumata, **workflows can receive permissions just like people**, allowing them to interact with authorized resources during execution."},{"type":"paragraph","text":"This is particularly useful when building automations that work with databases, storage, services, or protected credentials."},{"type":"paragraph","text":"Rather than giving an automation unrestricted access, you can authorize only the operations it needs."},{"type":"heading","text":"Configure access for a workflow"},{"type":"steps","items":["Open the resource the workflow needs to access, such as a database, storage bucket, or secret.","Select **Manage access**.","Review the available groups and resource permissions.","Grant access through the appropriate group associated with the workflow's execution identity.","Select only the actions required for the intended automation.","Save the permissions.","Run the workflow with suitable test data and verify that it can perform its intended operations."]},{"type":"heading","text":"Example: Automated order processing"},{"type":"paragraph","text":"Imagine you've created a workflow that processes new customer orders."},{"type":"paragraph","text":"It may need permission to:"},{"type":"steps","items":["Read relevant order information from your database.","Update the order's processing status.","Access a stored API credential to communicate with an external payment service.","Write the result back to the appropriate database resource."]},{"type":"paragraph","text":"The workflow doesn't need access to unrelated customer records, other workflows, or every secret in your project."},{"type":"paragraph","text":"By granting targeted permissions, you can automate the process while limiting unnecessary access."},{"type":"note","title":"Good to know","text":"A workflow's permissions determine which protected resources it is authorized to access. Having a workflow or Activity configured doesn't automatically grant it permission to use every resource."}]},{"id":"boundary","title":"6. Keep team access separate from application users","blocks":[{"type":"paragraph","text":"There's an important difference between **people collaborating in Rumata** and **customers using your published application**."},{"type":"heading","text":"Rumata workspace permissions"},{"type":"paragraph","text":"These control access to your development resources, such as factories, databases, workflows, storage, and backend services."},{"type":"paragraph","text":"They determine what your teammates and authorized automations can do inside Rumata."},{"type":"heading","text":"Your application's user permissions"},{"type":"paragraph","text":"These control what customers or end users can see and do inside the application you've built."},{"type":"paragraph","text":"For example, a customer portal may have administrators, employees, and customers, each with different access to information and features."},{"type":"paragraph","text":"These application-level rules must be implemented and enforced by the application's authentication and backend authorization."},{"type":"note","title":"Important","text":"Giving someone access to Rumata resources isn't the same as giving them an account in your published application."},{"type":"paragraph","text":"Likewise, your application's customer roles don't automatically grant access to the Rumata development workspace."}]},{"id":"trouble","title":"7. Review and troubleshoot permissions","blocks":[{"type":"paragraph","text":"If a teammate or workflow can't access a resource, check the specific permission configuration before granting broader access."},{"type":"heading","text":"Troubleshoot missing access"},{"type":"steps","items":["Confirm that you're working in the correct project and factory.","For a teammate, verify their Rumata nickname and that they've accepted the group invitation.","Open **Permissions → Groups** and check the intended group membership.","Open the resource's **Manage access** settings.","Verify that the correct group has permission for the requested action.","For workflows, check the execution identity and its assigned resource permissions.","Test the action again after resolving the issue."]},{"type":"note","title":"Tip","text":"Avoid granting unrestricted permissions simply to make an error disappear. Identify the specific resource and action that require access."}]},{"id":"keep-going","title":"Precise control, without limiting collaboration","blocks":[{"type":"paragraph","text":"Rumata's permission system is designed to let people and automations work together securely."},{"type":"paragraph","text":"You can organize teammates into groups, control access to individual resources, define permitted actions, and authorize workflows to interact with the resources they need."},{"type":"paragraph","text":"Whether you're collaborating with a small team or managing a complex application, Rumata gives you the flexibility to control who—or what—can access each part of your system."}]}],"updated":"2026-09-29","audience":"general","media":[{"src":"https://docs.rumata.dev/media/system-explorer/permissions.png","sectionId":"create","width":1536,"height":1024,"alt":"Create a named group, then grant resource permissions separately.","caption":"Create a named group, then grant resource permissions separately. Illustrative interface reference; your resources and values may differ."}],"video":null,"url":"https://docs.rumata.dev/guides/system-explorer-permissions"}