# Roles A role defines a set of permissions that can be assigned to a [subject in a scope](/self-hosted/platform-management/aiinitiatives/adapting-ai-initiatives.md#scopes-in-an-organization), determining which actions the subject is allowed to perform on NVIDIA Run:ai entities such as projects, workloads, and users. Each permission represents an allowed action including view, create, edit, and delete on a specific entity. Related permissions are grouped into permission sets, which bundle actions for a particular functional area (for example, managing workloads). These permission sets act as reusable building blocks that simplify role definition and ensure consistent access control across the platform. NVIDIA Run:ai provides [predefined roles](#roles-in-nvidia-run-ai) for common use cases and allows administrators to create [custom roles](#custom-roles-api-only) to meet specific organizational requirements. ## Roles Table The Roles table can be found under **Access** in the NVIDIA Run:ai platform. The Roles table displays a list of roles available to users in the NVIDIA Run:ai platform. Both predefined and custom roles will be displayed in the table.

The Roles table consists of the following columns: | Column | Description | | ------------- | --------------------------------------- | | Role | The name of the role | | Created by | The name of the role creator | | Creation time | The timestamp when the role was created | ### Customizing the Table View * Filter - Click ADD FILTER, select the column to filter by, and enter the filter values * Search - Click SEARCH and type the value to search by * Sort - Click each column header to sort by * Column selection - Click COLUMNS and select the columns to display in the table * Download table - Click MORE and then Click Download as CSV. Export to CSV is limited to 20,000 rows. ## Reviewing a Role 1. To review a role click the role name on the table 2. In the role form review the following: * **Role name**\ The name of the role * **Entity**\ A system-managed object that can be viewed, edited, created or deleted by a user based on their assigned role and scope * **Actions**\ The actions that the role assignee is authorized to perform for each entity * **View** - If checked, an assigned user with this role can view instances of this type of entity within their defined scope * **Edit** - If checked, an assigned user with this role can change the settings of an instance of this type of entity within their defined scope * **Create** - If checked, an assigned user with this role can create new instances of this type of entity within their defined scope * **Delete** - If checked, an assigned user with this role can delete instances of this type of entity within their defined scope ## Roles in NVIDIA Run:ai NVIDIA Run:ai supports the following roles and their permissions. Under each role is a detailed list of the actions that the role assignee is authorized to perform for each entity. {% hint style="info" %} **Note** Legacy roles are **deprecated** and will be removed in a future release. Review the new predefined roles to determine whether they meet your requirements, or create a [custom role](#custom-role-management-api-only) using the API. * L1 researcher, L2 researcher, ML engineer → consider using AI practitioner * Data source administrator, Data volume administrator → consider using Data & storage administrator * Research manager → consider using Project administrator {% endhint %}

AI practitioner

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	false	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	false	false	false	false
Settings	true	false	false	false
Clusters	false	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	true	true	true
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	false	false	false
Environments	true	true	true	true
PVC	true	false	false	false
Registries	true	true	true	true
Storage class configurations	true	false	false	false
Templates	true	true	true	true

Compute resource administrator Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	true	true	true
Credentials	false	false	false	false
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	false	false	false	false
Templates	true	false	false	false

Credentials administrator Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	true	true	true
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	false	false	false	false
Templates	true	false	false	false

Data and storage administrator

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	false	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	false	false	false	false
Projects	true	false	false	false
Security settings	false	false	false	false
Settings	true	false	false	false
Clusters	false	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	false	false	false
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	false	false	false
PVC	true	true	true	true
Registries	true	false	false	false
Storage class configurations	true	true	true	true
Templates	true	false	false	false

Data source administrator Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	false	false	false
Data sources	true	true	true	true
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	true	true	true
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	false	false	false

Data volume administrator Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	false	false	false
Data sources	true	false	false	false
Data volumes	true	true	true	true
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	false	false	false	false
Templates	true	false	false	false

Department administrator

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	true	true	true
Projects	true	true	true	true
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	false	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	true	false	false	false
Access rules	true	true	true	true
Applications	true	true	true	true
Roles	true	false	false	false
Service accounts	true	true	true	true
Users	true	true	true	true
Inferences	true	true	true	true
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	true	true	true
Storage class configurations	true	true	true	true
Templates	true	true	true	true

Department administrator (Legacy) Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	true	true	true
Projects	true	true	true	true
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	true	false	false	false
Access rules	true	true	true	true
Applications	true	true	true	true
Roles	true	false	false	false
Service accounts	true	true	true	true
Users	true	true	true	true
Inferences	true	true	true	true
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	true	true	true
Storage class configurations	true	true	true	true
Templates	true	true	true	true

Department viewer

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	false	false	false
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	false	false	false

Editor

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	true	true	true
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	true	true	true
Projects	true	true	true	true
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	true	false	false	false
Access rules	true	true	true	true
Applications	true	false	false	false
Roles	true	false	false	false
Service accounts	true	false	false	false
Users	true	false	false	false
Inferences	true	true	true	true
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	true	true	true
Storage class configurations	true	true	true	true
Templates	true	true	true	true

Environment administrator Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	false	false	false	false
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	true	true	true
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	false	false	false	false
Templates	true	false	false	false

L1 researcher Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	false	false	false	false
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	false	false	false
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	false	false	false
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	true	true	true

L2 researcher Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	false	false	false	false
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	false	false	false
Credentials	true	false	false	false
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	false	false	false

ML engineer Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	true	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	true	true	true
Trainings	false	false	false	false
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	true	true	true
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	false	false	false

Project administrator

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	false	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	true	true	true
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	false	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	true	true	true	true
Applications	true	false	false	false
Roles	true	false	false	false
Service accounts	true	false	false	false
Users	false	false	false	false
Inferences	true	true	true	true
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	true	true	true
Storage class configurations	true	true	true	true
Templates	true	true	true	true

Research manager Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	true	true	true
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	true	true	true	true
Applications	false	false	false	false
Roles	true	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	false	false	false
Trainings	true	true	true	true
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	false	false	false
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	true	true	true

System administrator

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	true	true	true
Departments	true	true	true	true
Event history	true	false	false	false
Network topologies	true	true	true	true
Policies	true	true	true	true
Projects	true	true	true	true
Security settings	true	true	true	true
Settings	true	true	true	true
Clusters	true	true	true	true
Clusters minimal	true	false	false	false
Node pools	true	true	true	true
Node pools minimal	true	false	false	false
Nodes	true	false	false	false
Access rules	true	true	true	true
Applications	true	true	true	true
Roles	true	true	true	true
Service accounts	true	true	true	true
Users	true	true	true	true
Inferences	true	true	true	true
Trainings	true	true	true	true
Workload properties	true	true	true	true
Workloads	true	true	true	true
Workspaces	true	true	true	true
Compute resources	true	true	true	true
Credentials	true	true	true	true
Data sources	true	true	true	true
Data volumes	true	true	true	true
Environments	true	true	true	true
PVC	true	true	true	true
Registries	true	true	true	true
Storage class configurations	true	true	true	true
Templates	true	true	true	true

Template administrator Legacy

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	false	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	false	false	false	false
Node pools minimal	true	false	false	false
Nodes	false	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	false	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	false	false	false	false
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	true	true	true

Viewer

Entity	View	Edit	Create	Delete
Account	true	false	false	false
Branding settings	true	false	false	false
Departments	true	false	false	false
Event history	false	false	false	false
Network topologies	true	false	false	false
Policies	true	false	false	false
Projects	true	false	false	false
Security settings	true	false	false	false
Settings	true	false	false	false
Clusters	true	false	false	false
Clusters minimal	true	false	false	false
Node pools	true	false	false	false
Node pools minimal	true	false	false	false
Nodes	true	false	false	false
Access rules	false	false	false	false
Applications	false	false	false	false
Roles	false	false	false	false
Service accounts	false	false	false	false
Users	false	false	false	false
Inferences	true	false	false	false
Trainings	true	false	false	false
Workload properties	true	false	false	false
Workloads	true	false	false	false
Workspaces	true	false	false	false
Compute resources	true	false	false	false
Credentials	true	false	false	false
Data sources	true	false	false	false
Data volumes	true	false	false	false
Environments	true	false	false	false
PVC	true	false	false	false
Registries	true	false	false	false
Storage class configurations	true	false	false	false
Templates	true	false	false	false

## Custom Roles (API Only) Administrators can create and manage custom roles to meet specific organizational access requirements using the [Roles](https://run-ai-docs.nvidia.com/api/2.25/authentication-and-authorization/roles) API. A custom role defines access by combining one or more **permission sets**, which together determine the actions that can be performed across NVIDIA Run:ai resources. By selecting the appropriate permission sets, administrators can tailor roles to match their organization’s access model while maintaining consistent and controlled authorization across the platform. {% hint style="info" %} **Note** Custom roles can be created and managed via API only. Once created, they are available for viewing in the Roles grid and can be selected when assigning access rules in the UI and API. {% endhint %} ### Permission Sets Permission sets are the building blocks of both predefined and custom roles. They represent the complete set of privileges required for a role to perform specific operations across NVIDIA Run:ai resources. A permission set is constructed from a collection of permissions. Each permission within a permission set defines: * a **resource type**, and * the allowed **actions** on that resource: `create`, `read`, `update`, or `delete` The Permission sets API provides a catalog of all available permission sets in the NVIDIA Run:ai platform. Permission sets may overlap in the resource types or actions they include. For more details, see the [Permissions](https://run-ai-docs.nvidia.com/api/2.25/authentication-and-authorization/permissions) API. #### Permission Set Naming and Scope Permission sets are designed to group actions logically, following a clear pattern to define scope. To view the complete list of permission sets and understand how each is defined, see the [Permissions](https://run-ai-docs.nvidia.com/api/2.25/authentication-and-authorization/permissions) API: * Edit Access (`EditAccess`) - These sets grant full CRUD (Create, Read, Update, Delete) permissions over the specified resource type, along with Read access to any associated data or dependencies required for management. For example, **workspaceEditAccess** grants full permissions to `create`, `read`, `update`, and `delete` workspaces, and `read` access all related data and resources required for their management, such as: * `workloads` * `workload-properties` * `nodepools-minimal` * `clusters-minimal` * `projects` * `templates` * `environments` * `compute-resources` * `pvc-assets` * Read Access (`ReadAccess`) - These sets grant only view permissions for the specific resource and its related components. For example, **workloadReadAccess** grants permissions to `read` workloads, and `read` access all related data and resources associated with them, such as: * `workspaces` * `trainings` * `inferences` * `workload-properties` * `nodepools-minimal` * `clusters-minimal` * `projects` ### Creating a Custom Role #### Requirements for Custom Roles Custom roles must meet the following requirements: * **UI access permissions** - To allow a custom role to access the NVIDIA Run:ai user interface, include the following permission sets: * `settingsReadAccess` * `accountReadAccess` * `brandingSettingsReadAccess` * `securitySettingsReadAccess` * **Kubernetes (cluster) permissions** - Kubernetes permissions are **required only** if the role needs direct access to the Kubernetes cluster. If cluster access is required, the custom role must include a `kubernetesPermissions` object. This ensures the role inherits Kubernetes cluster-level permissions from an existing predefined NVIDIA Run:ai role. #### Steps for Creating a Custom Role 1. Identify the required permission sets: * Determine the capabilities the new role needs (e.g., managing training jobs, viewing clusters, etc.). * Retrieve the full catalog of available permission set identifiers (`name` and `id`) using the `GET /v1/api/permission-sets` endpoint. This provides the list of all valid IDs (e.g., `inferenceEditAccess`, `workloadReadAccess`) to populate the `permissionSets` array in your request body. * Include `settingsReadAccess`, `accountReadAccess`, `brandingSettingsReadAccess` and `securitySettingsReadAccess` to allow the custom role access the NVIDIA Run:ai user interface. 2. (Optional) Identify the Kubernetes predefined role ID. The custom role must inherit its underlying Kubernetes cluster permissions from an existing NVIDIA Run:ai predefined role if the role needs to access the Kubernetes cluster directly: * Retrieve the list of all available predefined roles using the `GET /v2/authorization/roles` endpoint. * Select the unique ID (a string identifier, e.g., "12") of the predefined role that grants the appropriate level of cluster access for your custom role. * This ID will populate the `predefinedRole` field under the `kubernetesPermissions` object. 3. Construct and send the API request. Use the `POST /v2/authorization/roles` endpoint to create the role. **Example: MLOps Role** This example demonstrates a role that can fully manage inference workloads and access related monitoring information. ```json { "name": "MLOps", "description": "Fully manage inference workloads, and access other relevant information for monitoring", "permissionSets": [ { "name": "inferenceEditAccess", "id": "" }, { "name": "templatesEditAccess", "id": "" }, { "name": "dataAndStorageReadAccess", "id": "" }, { "name": "nodesReadAccess", "id": "" }, { "name": "clustersReadAccess", "id": "" }, { "name": "settingsReadAccess", "id": "" }, { "name": "accountReadAccess", "id": "" } ], "kubernetesPermissions": { "predefinedRole": "12" } } ``` ### Enabling / Disabling Custom Roles Administrators can control whether it is available for use by enabling or disabling it: * **Enabled** - Can be assigned to users and used in access rules. * **Disabled** - Remain defined in the system but cannot be assigned to users or used in access rules. ### Troubleshooting Common Issues

Can't delete role

**Description:** The role cannot be deleted. **Mitigation:** 1. Verify that the role is not assigned to any users. 2. If the role is currently in use, disable the role first, and then delete it.

Permissions not taking effect

**Description:** The selected permission sets are not taking effect. **Mitigation:** 1. Ensure that the role is **enabled**. 2. Verify that the user has been **assigned the role**. 3. Check for **conflicting permissions** granted by other roles assigned to the user.

Cluster permissions not working

**Description:** Cluster-level permissions are not taking effect. **Mitigation:** 1. Verify that the required ClusterRole exists in all relevant clusters. 2. Confirm that the cluster version is 2.21 or later. 3. Ensure that the cluster is properly connected to the tenant.

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://run-ai-docs.nvidia.com/self-hosted/infrastructure-setup/authentication/roles.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.