Manage accounts
How to manage account roles
Configure user workspace roles in Prefect Cloud.
Prefect Cloud’s Pro and Enterprise tiers allow you to set team member
access to the appropriate level within specific workspaces.
Role-based access controls (RBAC) enable you to assign users granular permissions to perform certain activities.
Enterprise account administrators can create custom roles for users to give users access to capabilities
beyond the scope of Prefect’s built-in workspace roles.
Built-in roles
Roles give users abilities at either the account level or at the individual workspace level.- An account-level role defines a user’s default permissions within an account.
- A workspace-level role defines a user’s permissions within a specific workspace.
Account-level roles
The following built-in roles have permissions across an account in Prefect Cloud.| Role | Abilities |
|---|---|
| Owner | - Set/change all account profile settings allowed to be set/changed by a Prefect user. - Add and remove account members, and their account roles. - Create and delete service accounts in the account. - Create workspaces in the account. - Implicit workspace owner access on all workspaces in the account. - Bypass SSO. |
| Admin | - Set/change all account profile settings allowed to be set/changed by a Prefect user. - Add and remove account members, and their account roles. - Create and delete service accounts in the account. - Create workspaces in the account. - Implicit workspace owner access on all workspaces in the account. - Cannot bypass SSO. |
| Member | - View account profile settings. - View workspaces you have access to in the account. - View account members and their roles. - View service accounts in the account. |
Workspace-level roles
The following built-in roles have permissions within a given workspace in Prefect Cloud.| Role | Abilities |
|---|---|
| Viewer | - View flow runs within a workspace. - View deployments within a workspace. - View all work pools within a workspace. - View all blocks within a workspace. - View all automations within a workspace. - View workspace handle and description. |
| Runner | All Viewer abilities, plus: - Run deployments within a workspace. |
| Developer | All Runner abilities, plus: - Run flows within a workspace. - Delete flow runs within a workspace. - Create, edit, and delete deployments within a workspace. - Create, edit, and delete work pools within a workspace. - Create, edit, and delete all blocks and their secrets within a workspace. - Create, edit, and delete automations within a workspace. - View all workspace settings. |
| Owner | All Developer abilities, plus: - Add and remove account members, and set their role within a workspace. - Set the workspace’s default workspace role for all users in the account. - Set, view, edit workspace settings. |
| Worker | The minimum scopes required for a worker to poll for and submit work. |
Custom workspace roles
The built-in roles serve the needs of most users, but custom roles give users access to specific permissions within a workspace. Custom roles can inherit permissions from a built-in role. This enables tweaks to the role to meet your team’s needs, while ensuring users still benefit from Prefect’s default workspace role permission curation as new capabilities becomes available. You can create custom workspace roles independently of Prefect’s built-in roles. This option gives workspace admins full control of user access to workspace capabilities. However, for non-inherited custom roles, the workspace Admin takes on the responsibility for monitoring and setting permissions for new capabilities as it is released. See Role permissions for details of permissions you may set for custom roles. After you create a new role, it becomes available in the account Members page and the Workspace Sharing page for you to apply to users.Inherited roles
You can configure a custom role as an Inherited Role. Using an inherited role allows you to create a custom role from a set of initial permissions associated with a built-in Prefect role. You can add additional permissions to the custom role. Permissions included in the inherited role cannot be removed. Custom roles created from an inherited role follow Prefect’s default workspace role permission curation as new capabilities becomes available. To configure an inherited role alongside a custom role, select Inherit permission from a default role, then select the role from which the new role should inherit permissions.Workspace role permissions
The following permissions are available for custom roles.Automations
| Permission | Description |
|---|---|
| View automations | User can see configured automations within a workspace. |
| Create, edit, and delete automations | User can create, edit, and delete automations within a workspace. Includes permissions of View automations. |
Blocks
| Permission | Description |
|---|---|
| View blocks | User can see configured blocks within a workspace. |
| View secret block data | User can see configured blocks and their secrets within a workspace. Includes permissions of View blocks. |
| Create, edit, and delete blocks | User can create, edit, and delete blocks within a workspace. Includes permissions of View blocks and View secret block data. |
Deployments
| Permission | Description |
|---|---|
| View deployments | User can see configured deployments within a workspace. |
| Run deployments | User can run deployments within a workspace. This does not give a user permission to execute the flow associated with the deployment. This only gives a user (through their key) the ability to run a deployment—another user/key must actually execute that flow, such as a service account with an appropriate role. Includes permissions of View deployments. |
| Create and edit deployments | User can create and edit deployments within a workspace. Includes permissions of View deployments and Run deployments. |
| Delete deployments | User can delete deployments within a workspace. Includes permissions of View deployments, Run deployments, and Create and edit deployments. |
Flows
| Permission | Description |
|---|---|
| View flows and flow runs | User can see flows and flow runs within a workspace. |
| Create, update, and delete saved search filters | User can create, update, and delete saved flow run search filters configured within a workspace. Includes permissions of View flows and flow runs. |
| Create, update, and run flows | User can create, update, and run flows within a workspace. Includes permissions of View flows and flow runs. |
| Delete flows | User can delete flows within a workspace. Includes permissions of View flows and flow runs and Create, update, and run flows. |
Notifications
| Permission | Description |
|---|---|
| View notification policies | User can see notification policies configured within a workspace. |
| Create and edit notification policies | User can create and edit notification policies configured within a workspace. Includes permissions of View notification policies. |
| Delete notification policies | User can delete notification policies configured within a workspace. Includes permissions of View notification policies and Create and edit notification policies. |
Task run concurrency
| Permission | Description |
|---|---|
| View concurrency limits | User can see configured task run concurrency limits within a workspace. |
| Create, edit, and delete concurrency limits | User can create, edit, and delete task run concurrency limits within a workspace. Includes permissions of View concurrency limits. |
Work pools
| Permission | Description |
|---|---|
| View work pools | User can see work pools configured within a workspace. |
| Create, edit, and pause work pools | User can create, edit, and pause work pools configured within a workspace. Includes permissions of View work pools. |
| Delete work pools | User can delete work pools configured within a workspace. Includes permissions of View work pools and Create, edit, and pause work pools. |
Workspace management
| Permission | Description |
|---|---|
| View information about workspace service accounts | User can see service accounts configured within a workspace. |
| View information about workspace users | User can see user accounts for users invited to the workspace. |
| View workspace settings | User can see settings configured within a workspace. |
| Edit workspace settings | User can edit settings for a workspace. Includes permissions of View workspace settings. |
| Delete the workspace | User can delete a workspace. Includes permissions of View workspace settings and Edit workspace settings. |