Using user roles and permissions

IMPORTANT: This guide only applies to Next-Gen WAF customers with access to the Next-Gen WAF control panel. If you have access to the Next-Gen WAF product in the Fastly control panel, check out our guide to managing users of Fastly accounts.

Every user in your account (also known as corp) is assigned a role. Roles are groups of permissions that afford users the ability to view and control a variety of things in your account (corp).

  • Owners have access to all account (corp) features, can edit settings on every workspace (also known as site), and can make changes to user accounts.
  • Admins have limited access to account (corp) features, access to specific workspaces (sites) and site-level (workspace-level) settings, and can invite new users to specific workspaces (sites).
  • Users have access to specific workspaces (sites) and site-level (workspace-level) settings.
  • Observers have access to specific workspaces (sites).

Account (corp) management permission

The account (corp) management permissions for each role are as follows:

PermissionOwnerAdminUserObserver
View account-wide (corp-wide) data and reportsAccessLimited accessLimited accessLimited access
Edit account-wide (corp-wide) security policiesAccessNo accessNo accessNo access
Create or edit account (corp) rulesAccessNo accessNo accessNo access
View account (corp) rulesAccessAccessAccessAccess
Create or edit account (corp) listsAccessNo accessNo accessNo access
Create or edit account (corp) signalsAccessNo accessNo accessNo access
View account (corp) integrationsAccessAccessAccessAccess
Edit account (corp) integrationsAccessNo accessNo accessNo access
View account (corp) audit logsAccessAccessAccessAccess

User management permissions

The user management permissions for each role are as follows:

PermissionOwnerAdminUserObserver
View usersAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Invite or remove other usersAll workspaces (sites)Specific workspaces (sites)No workspaces (sites)No workspaces (sites)
Allow users to create API Access TokensAccessNo accessNo accessNo access

Workspace (site) management permissions

The workspace (site) management permissions for each role are as follows:

PermissionOwnerAdminUserObserver
Create or delete workspaces (sites)AccessNo accessNo accessNo access
View site-level (workspace-level) data and reportsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Edit workspace (site) blocking modeAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
Edit workspace (site) IP anonymization policyAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
Edit workspace (site) default blocking response codeAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View associated usersAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
Edit workspace (site) Display Name and Short NameAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)

Workspace (site) configuration permissions

The workspace (site) configuration permissions for each role are as follows:

PermissionOwnerAdminUserObserver
Change Blocking ModeAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
Create or edit rulesAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View rulesAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Create or edit signalsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View signalsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Create or edit listsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View listsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Create or edit redactionsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View redactionsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Create or edit integrationsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View integrationsAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)
Create agent keysAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View agent keysAll workspaces (sites)Specific workspaces (sites)Specific workspaces (sites)No workspaces (sites)
View workspace (site) audit logsAccessAccessAccessAccess

Personal account management permissions

The personal account management permissions for each role are as follows:

PermissionOwnerAdminUserObserver
Edit account profile informationAccessAccessAccessAccess
Create, edit, view support ticketsAccessAccessAccessAccess
Create API Access TokenLimited accessLimited accessLimited accessLimited access