Becoming familiar with your role and the available actions you can perform based on your role type is one important step in understanding how Cutover operates.
Overview
The following role type categories are available for users in the Cutover platform:
Within each category, there are specific roles that can be assigned to suit your organization's structure. Additionally, you have the ability to assign multiple roles to the same user.
Global roles
Within the global category are two role types:
These roles can be assigned to a user in Access Management when adding a new user to your Cutover instance.
Global user admin
A Global user admin can manage all users and roles within the Cutover system. This means this role can access the Access Management area for user management and can view different role types that exist. This role has access to accounts; however, it cannot read any runbooks that sit within Cutover.
This role is available for RBAC.
What a Global user admin can do:
What a Global user admin can do:
Homepage and Profile: Read homepage; update own profile details; (excl. email, roles and login option).
Workspace Views: Read runbooks list view; schedule runbook sharing; read folders; snippet list view; template list view; workspace data sources; and central teams.
Global Settings: Create, read, update, and archive user accounts; export user history; read role types page; create workspaces; manage RBAC mappings.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Global stakeholder
A Global stakeholder is a read-only role that allows a user to view all settings, information, and data within an instance. This role can also access runbook dashboards and tasks.
This role is available for RBAC.
What a Global stakeholder can do:
What a Global stakeholder can do:
Homepage and Profile: Read homepage; update own profile detail; (excl. email, roles and login option).
Workspace and Runbook Access: Read runbooks list view; access individual runbooks; read folders; snippet list view; template list view; workspace data sources; and central teams.
Audit and Saved Views: Save as saved view; view version history; download audit log; save template as saved view; view template version history; view template audit log.
Global Settings Visibility: Read Access Management users page; export user history; read role types page, workspaces page, dashboards, runbook types, task types, integrations page, data sources page, custom fields page, and custom fields groups page.
AI Capabilities: Access AI Assistant for runbook/workspace.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Workspace roles
Within the workspace category are four role types:
These roles can be assigned to a user in Access Management when adding a new user to your Cutover instance.
There is also a Workspace Template Reviewer role. When assigned, it allows the user to approve or reject workflows within a workspace.
Workspace manager
A Workspace manager is an admin role that has the ability to edit workspace properties, define settings, and perform user management tasks for a workspace. Workspace managers also have read-only access to everything that sits within their workspace, such as runbooks.
This role is available for RBAC.
What a Workspace manager can do:
What a Workspace manager can do:
Homepage and Profile: Read homepage; update own profile details; (excl. email, roles and login option).
Workspace and Folders: Create, read, update, and delete folders; read runbooks list view; access runbooks, read snippet list view and access snippets; read template list view and access templates; read workspace data sources.
Central Teams: Create, read, update, and delete Central Teams.
Runbook and Template Settings: Save as saved view; view version history; download audit log; set own time zone; star runbook; switch to highlight mode; save task list filtered view; save template as saved view; view template version history; view template audit log.
Global Settings: Create, read, update, and archive user accounts; export user history; create, read, and update dashboards; create, read, and update runbook types.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Workspace runbook creator
A Workspace runbook creator can create runbooks in a specified workspace without having higher-level access to settings to edit a workspace itself. A workspace runbook creator can create and duplicate runbooks in the workspace they've been assigned.
This role does not give visibility into all runbooks in a workspace. A workspace runbook creator can only view and access runbooks with a role they're associated with, such as runbook admin, stream editor, or in a runbook team.
This role is available for RBAC.
What a Workspace runbook creator can do:
What a Workspace runbook creator can do:
Homepage and Profile: Read homepage; create runbook from homepage; update own profile details (excl. email, roles and login option).
Runbook and Workspace Operations: Create runbook, merge runbooks (into new runbook), duplicate runbook, and schedule runbook sharing; read folders; create snippet and read snippet list view.
Templates and Data Sources: Duplicate template (create from template); read template list view, and create a template; read data sources workspace view; create templates from data sources; duplicate runbook from settings cog; create runbook from template.
AI Capabilities: Create runbook/workspace using AI.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Workspace stakeholder
A Workspace stakeholder can view everything in a specified workspace, including user management, settings, and runbooks. This role is typically given to users that do not need to make updates but would like to have visibility in a specific workspace without needing access and visibility into all workspaces in an instance.
This role is available for RBAC.
What a Workspace stakeholder can do:
What a Workspace stakeholder can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Access: Read runbooks list view and access individual runbooks; read folders; read snippet list view and access snippets; read template list view and access templates; read workspace data sources; read central teams.
Runbook Views and Audits: Save as saved view; view version history; download audit log; set own time zone; star runbook; switch to highlight mode; save task list filtered view; save template as saved view; view template version history, and view template audit log.
Global Settings and AI: Export user history; read dashboards; read runbook types; access AI Assistant for runbook/workspace.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Workspace member
A Workspace member has the least available permissions. A workspace member can access the workspace but not view specific details until they have been granted further permissions or until they've been added to a runbook.
This role is typically granted to users that are only required to execute tasks they are assigned in a runbook.
This role is available for RBAC.
What a Workspace member can do:
What a Workspace member can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Access: Read runbooks list view (only see runbooks you are assigned); schedule share; read folders; read snippet list view.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Workspace Template Reviewer
Users assigned this role will appear in the reviewer search field when submitting a template for review. If the role has been assigned to a central teams it also means that:
Review requests are sent to all members of the team.
The team name appears in the left-hand filter panel.
Only one team member needs to submit their review.
This role is available for RBAC.
What a Workspace Template Reviewer can do:
What a Workspace Template Reviewer can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Access: Read runbooks list view; schedule share; read folders; read snippet list view.
Workflow Approvals: Approve/reject template approval workflow requests.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Centralized team manager
A Centralized team manager allows a user to manage central teams within a workspace without needing workspace manager permissions.
These roles can be assigned to a user in Access Management when adding a new user to your Cutover instance.
For more information on central teams and how they work, please read our Central Teams help center article.
This role is available for RBAC.
What a Centralized team manager can do:
What a Centralized team manager can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Views: Read folders; read snippet list view; read template list view; read data sources workspace view.
Central Team Management: Create, read, update, and delete Central Teams.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Folder roles
Within the folder role category are two role types:
These roles can be assigned to a user within the Folder > Edit Folder panel of a workspace. In addition, folder runbook creators and stakeholders have access to (and can be added as members of) subfolders.
In order to assign users to these roles, they will need to be given access to the appropriate workspace.
Folder runbook creator
A Folder runbook creator can create runbooks in a specified folder but cannot see all other runbooks they have not created or are involved in.
This role is available for RBAC.
What a Folder runbook creator can do:
What a Folder runbook creator can do:
Homepage and Profile: Read homepage; create runbook from homepage; update own profile details (excl. email, roles and login option).
Runbook and Workspace Operations: Create runbook; merge runbooks (into new runbook); duplicate runbook; schedule share; read folders; read snippet list view.
Templates and Views: Duplicate template (create from template); read template list view; create a template; read data sources workspace view; duplicate runbook from settings cog; view runbook version history; create from template and view template version history.
AI Capabilities: Create runbook/workspace using AI.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Folder stakeholder
A Folder stakeholder can view all runbooks that sit within a specified folder but cannot make changes in a runbook until they are added as a runbook admin or team member.
This role is available for RBAC.
What a Folder stakeholder can do:
What a Folder stakeholder can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Access: Read runbooks list view; schedule share; read folders; read snippet list view, template list view and data sources workspace view.
Runbook Views and Execution: Save as saved view; view version history; download audit log; set own time zone; star runbook; switch to highlight mode; save task list filtered view; save template as saved view; view template version history; view template audit log.
Task and Stream : Download task list; read tasks, streams, and activity feed.
AI Capabilities: Access AI Assistant for runbook/workspace.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Runbook roles
Within the runbook role category are three role types:
These roles can be assigned to a user in the View Users/Teams panel in a runbook.
In order to assign users to these roles, they will need to be given access to the appropriate workspace.
Runbook admin
A Runbook admin can edit all assets within a runbook, including (but not limited to) creating and editing runbook teams and tasks, executing rehearsals and live runs, and runbooks.
A runbook creator will automatically inherit the runbook admin role when they create a runbook and can add additional runbook admins to allow others to collaborate on the execution of a runbook.
This role is NOT available for RBAC.
What a Runbook admin can do:
What a Runbook admin can do:
Homepage and Profile: Read homepage; update profile details (excl. email, roles and login option).
Workspace Overview: Merge (into existing runbook); read runbooks list view; update runbook details; delete and restore a runbook; schedule share; read folders; read workspace data sources.
Snippets and Templates Management: Read snippet list view; access, update and delete snippet; read template list view; update, archive, and restore template.
Runbook Settings: Archive runbook; import tasks from CSV; import runbook; save as saved view; save version; view version history; restore version; make template; download audit log; manage runbook users; add/remove scheduled start; set own time zone; star runbook; manage people and teams; switch to highlight mode; save task list filtered view; set filtered view default; make filtered view visible; share Single Runbook Dashboard (SRD).
Template Workflows: Mark as approved; request approval (workflow); request reapproval (workflow); create new template version; save template as saved view; view version history; view audit log.
Runbook Execution: Start, pause, and cancel runbook; send ad hoc comms; add people/teams; import users; export users; add runbook comment; download task list.
Task and Stream Control: Create tasks (manual); create runbook via linked task; add task comment on any task; read, update, and delete tasks; start, finish, skip, abandon, override, and duplicate tasks; insert linked task; insert snippet; task comment; create, read, update, and delete streams and substreams.
AI Capabilities: Access AI Assistant.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Stream editor
A Stream editor can manage substreams and tasks within their stream only. A stream editor is typically needed when a user only needs to manage specific streams and tasks without needing access to an entire runbook.
This role is NOT available for RBAC.
What a Stream editor can do:
What a Stream editor can do:
Homepage and Profile: Read homepage; update profile details (excl. email, roles and login option).
Workspace Views: Read runbooks list view; schedule share; read folders; read snippet list view and access snippets; read template list view; read data sources workspace view.
Runbook Views and Templates: Save as saved view; view version history; download audit log; set own time zone; switch to highlight mode; save task list filtered view; download template; save template as saved view; view template version history; view template audit log.
Runbook and Stream Communications: Send ad hoc comms; export users; add runbook comment; download task list.
Task and Streams: Create tasks (manual); create runbook via linked task; add task comment on any task; read, update, delete, and duplicate tasks; task comment; create streams and substreams; read streams.
AI Capabilities: Access AI Assistant.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Team member
A Team member can only access specific runbooks and action tasks they have been assigned to and has the least available permissions.
Note: A user can only be added as a team member if they have been added to a team within a runbook.
This role is NOT available for RBAC.
What a Team member can do:
What a Team member can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Views: Read runbooks list view; schedule share; read folders; read snippet list view and access snippets; read template list view; read workspace data sources.
Runbook Views: Save as saved view; view version history; restore version; download audit log; set own time zone; star runbook; switch to highlight mode; save task list filtered view; save template as saved view; view template version history; view template audit log.
Runbook: Add runbook comment; download task list.
Task Execution: Read tasks; add task comment on any task; start, finish, skip, and abandon task; task comment; read streams.
AI Capabilities: Access AI Assistant.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Integrations admin
An Integrations admin can view, create, and manage integrations and task types within the Global Settings of a Cutover instance. An integrations admin can only view a workspace — this means that this role type does not have access to user management settings or cannot edit runbooks directly, for example.
While other roles are able to handle tasks associated with integrations, such as removing an integration task from a runbook, the integrations admin is the only role type that can create or delete integrations, as well as access and manage an integration's settings.
This means that a workspace manager, for example, will be unable to access Global Settings to create or manage integrations directly.
This role is available for RBAC.
What an Integrations admin can do:
What an Integrations admin can do:
Homepage and Profile: Read homepage; update own profile details (excl. email, roles and login option).
Workspace Views: Schedule share; read folders; read snippet list view; read workspaces page.
Global settings: Create, read, update, and delete task types; create, read, update, and delete Integrations; create and download Cutover Connect configuration; edit Connect projects; read and update Event Integrations.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Custom fields admin
A Custom fields admin can access Custom Fields and Custom Field Groups within the Global Settings of a Cutover instance, with create, read, update and delete permissions. They can also create, read, update, delete and refresh Datasources.
This role is available for RBAC.
What a Custom fields admin can do:
What a Custom fields admin can do:
Profile: Update own profile details (excl. email, roles and login option).
Data Sources Settings: Create, read, update, delete, and refresh Data Sources.
Custom Fields Settings: Create, read, update, and delete Custom Fields; create, read, update, and delete Custom Fields Groups.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
SSO Admin
An SSO Admin can view SAML configurations, upload and manage role mappings, and manage SSO certificates for SAML. For more information, please see our help centre article here.
This role is available for RBAC.
What a SSO admin can do:
What a SSO admin can do:
Profile: Update own profile details (excl. email, roles and login option).
SAML configuration: Manage SAML Certificates; read SAML and RBAC, manage RBAC.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Developer Role
The Developer role allows an account to:
Generate and manage user app tokens.
Access and log in to the API instance.
A Global User Admin is required to assign the Developer role to a non-interactive account.
This role is available for RBAC.
What a Developer Role can do:
What a Developer Role can do:
Profile & API Credentials: Update own profile details (excl. email, roles and login option); View API endpoint documentation with credentials; Generate/manage User App Tokens.
AI Capabilities: Create runbook/workspace using AI; Access AI Assistant.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Use a non-interactive account for user app tokens
User app tokens should always be generated from a non-interactive account rather than a named user account.
If a token is generated from a user account and that user later leaves the organisation or their account is archived, any integrations using that token may fail.
AI User
The AI user role is available when the AI feature is enabled. This role has access to AI-powered features across the platform and can be assigned via Access Management page.
This role is available for RBAC.
What an AI User can do:
What an AI User can do:
Profile: Update own profile details (excl. email, roles and login option).
AI Capabilities: Create runbook/workspace using AI; Access AI Assistant.
Note: In the permissions list, Read means the functionality is available to the user. Access means the functionality is available and the content within it is visible to the user, subject to their assigned role and permissions.
Additional roles may be required
The Developer role provides access to API authentication and token management, but it does not grant permission to perform all API operations.
To successfully execute API calls, the non-interactive account must also be assigned any additional roles required for the operation being performed.
For example, to use the Archive a User operation, the account must have both the Developer role and the Global User Admin role. Without the required permissions, the API call will fail.
Before using the API, review the permissions required for your use case and ensure the non-interactive account has been assigned the appropriate roles.
Note: Instructions for assigning the Developer role and generating user app tokens for non-interactive accounts can be found in the Getting Started/Authentication section of the Developer Portal.