Access in kixctl is verb-level: every action is a discrete permission, checked at the point it runs, so a role can be granted exactly the verbs it should have. Roles group permissions — see Users, roles, and permissions. This page is the catalog.
The seeded roles frame the tiers below: operator holds the day-to-day verbs but not the destructive deletes or the widest-blast-radius edits, which are admin; viewer is read-only.
Instances
| Permission | Action | Tier |
|---|
instance.create | Create an instance | operator |
instance.start | Start an instance | operator |
instance.stop | Stop an instance | operator |
instance.restart | Restart an instance | operator |
instance.rename | Rename an instance | operator |
instance.config.update | Edit CPU and memory limits, nesting, autostart | operator |
instance.delete | Delete an instance (root filesystem only) | admin |
Snapshots
| Permission | Action | Tier |
|---|
snapshot.create | Create a snapshot | operator |
snapshot.restore | Restore a snapshot | operator |
snapshot.delete | Delete a snapshot | operator |
Profiles
| Permission | Action | Tier |
|---|
profile.attach | Attach a profile to an instance | operator |
profile.detach | Detach a profile from an instance | operator |
profile.update | Edit a profile definition | admin |
profile.update is admin-tier because a profile edit's blast radius is every instance that inherits it.
Deploy pools
| Permission | Action | Tier |
|---|
pool.create | Create a pool | operator |
pool.update | Edit a pool | operator |
pool.promote | Promote a pool with Update all | operator |
pool.delete | Delete a pool | admin |
Users
| Permission | Action | Tier |
|---|
user.manage | Create and manage users and their roles | admin |
The deploy lifecycle actions — cutover, revert, reap — are driven from the Updates tab; pooled promotion is gated on pool.promote. Managed networks are created, edited, and removed under Settings → Network with the same operator-and-admin split, where destructive removal is the admin verb.