Using user roles and permissions
- English
- 日本語
IMPORTANT: This guide only applies to Next-Gen WAF customers with access to the Next-Gen WAF control panel. If you have access to the Next-Gen WAF product in the Fastly control panel, check out our guide to managing users of Fastly accounts.
Every user in your account (also known as corp) is assigned a role. Roles are groups of permissions that afford users the ability to view and control a variety of things in your account (corp).
- Owners have access to all account (corp) features, can edit settings on every workspace (also known as site), and can make changes to user accounts.
- Admins have limited access to account (corp) features, access to specific workspaces (sites) and site-level (workspace-level) settings, and can invite new users to specific workspaces (sites).
- Users have access to specific workspaces (sites) and site-level (workspace-level) settings.
- Observers have access to specific workspaces (sites).
Account (corp) management permission
The account (corp) management permissions for each role are as follows:
| Permission | Owner | Admin | User | Observer |
|---|---|---|---|---|
| View account-wide (corp-wide) data and reports | Access | Limited access | Limited access | Limited access |
| Edit account-wide (corp-wide) security policies | Access | No access | No access | No access |
| Create or edit account (corp) rules | Access | No access | No access | No access |
| View account (corp) rules | Access | Access | Access | Access |
| Create or edit account (corp) lists | Access | No access | No access | No access |
| Create or edit account (corp) signals | Access | No access | No access | No access |
| View account (corp) integrations | Access | Access | Access | Access |
| Edit account (corp) integrations | Access | No access | No access | No access |
| View account (corp) audit logs | Access | Access | Access | Access |
User management permissions
The user management permissions for each role are as follows:
| Permission | Owner | Admin | User | Observer |
|---|---|---|---|---|
| View users | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Invite or remove other users | All workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) | No workspaces (sites) |
| Allow users to create API Access Tokens | Access | No access | No access | No access |
Workspace (site) management permissions
The workspace (site) management permissions for each role are as follows:
| Permission | Owner | Admin | User | Observer |
|---|---|---|---|---|
| Create or delete workspaces (sites) | Access | No access | No access | No access |
| View site-level (workspace-level) data and reports | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Edit workspace (site) blocking mode | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| Edit workspace (site) IP anonymization policy | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| Edit workspace (site) default blocking response code | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View associated users | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| Edit workspace (site) Display Name and Short Name | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
Workspace (site) configuration permissions
The workspace (site) configuration permissions for each role are as follows:
| Permission | Owner | Admin | User | Observer |
|---|---|---|---|---|
| Change Blocking Mode | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| Create or edit rules | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View rules | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Create or edit signals | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View signals | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Create or edit lists | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View lists | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Create or edit redactions | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View redactions | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Create or edit integrations | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View integrations | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) |
| Create agent keys | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View agent keys | All workspaces (sites) | Specific workspaces (sites) | Specific workspaces (sites) | No workspaces (sites) |
| View workspace (site) audit logs | Access | Access | Access | Access |
Personal account management permissions
The personal account management permissions for each role are as follows:
| Permission | Owner | Admin | User | Observer |
|---|---|---|---|---|
| Edit account profile information | Access | Access | Access | Access |
| Create, edit, view support tickets | Access | Access | Access | Access |
| Create API Access Token | Limited access | Limited access | Limited access | Limited access |
