# Permissions

Access in kixctl is verb-level: every action is a discrete permission, checked at the point it runs, so a role can be granted exactly the verbs it should have. Roles group permissions — see [Users, roles, and permissions](../advanced/users-and-roles.md). This page is the catalog.

The seeded roles frame the tiers below: **operator** holds the day-to-day verbs but not the destructive deletes or the widest-blast-radius edits, which are **admin**; **viewer** is read-only.

## Instances

| Permission | Action | Tier |
| --- | --- | --- |
| `instance.create` | Create an instance | operator |
| `instance.start` | Start an instance | operator |
| `instance.stop` | Stop an instance | operator |
| `instance.restart` | Restart an instance | operator |
| `instance.rename` | Rename an instance | operator |
| `instance.config.update` | Edit CPU and memory limits, nesting, autostart | operator |
| `instance.delete` | Delete an instance (root filesystem only) | admin |

## Snapshots

| Permission | Action | Tier |
| --- | --- | --- |
| `snapshot.create` | Create a snapshot | operator |
| `snapshot.restore` | Restore a snapshot | operator |
| `snapshot.delete` | Delete a snapshot | operator |

## Profiles

| Permission | Action | Tier |
| --- | --- | --- |
| `profile.attach` | Attach a profile to an instance | operator |
| `profile.detach` | Detach a profile from an instance | operator |
| `profile.update` | Edit a profile definition | admin |

`profile.update` is admin-tier because a profile edit's blast radius is every instance that inherits it.

## Deploy pools

| Permission | Action | Tier |
| --- | --- | --- |
| `pool.create` | Create a pool | operator |
| `pool.update` | Edit a pool | operator |
| `pool.promote` | Promote a pool with Update all | operator |
| `pool.delete` | Delete a pool | admin |

## Users

| Permission | Action | Tier |
| --- | --- | --- |
| `user.manage` | Create and manage users and their roles | admin |

The deploy lifecycle actions — cutover, revert, reap — are driven from the Updates tab; pooled promotion is gated on `pool.promote`. Managed networks are created, edited, and removed under **Settings → Network** with the same operator-and-admin split, where destructive removal is the admin verb.