Grant per-automation execution rights

A custom role can be allowed to run one named manual automation without being allowed to run any other. This lets you scope who can run which manual automation — kick vs. ban vs. broadcast — instead of an all-or-nothing “can run automations” toggle.

How it works

There is no per-automation permission key, and there is no row for one in the permission list — a key is resource:action, and a key named after a single automation cannot exist in that set. The right to run one automation is a link between a role and that automation: a second axis alongside the permission matrix.

The Run endpoint of a manual automation opens for either of two independent reasons:

• the member’s role holds automation:update, which opens every manual automation in the organization; or
• the member’s role is linked to that one automation, which opens only the automation named.

On the Roles screen this is one checkbox per automation, in the Automation actions rows. Checking it links the role to that automation; the role is saved as two separate things underneath, its permission keys and its linked automations, and the screen spares you the distinction.

Owner and Admin hold automation:update, so they already run every manual automation — nothing needs to be checked for them. Both are system roles: their matrix cells can’t be checked. Only a custom role you create can carry a link.

Wherever a manual automation’s Actions menu shows up — the player page or the Players table for player-targeted automations, or the server header on the Dashboard for server-targeted automations — an automation only appears for members who can run it. The menu lists only enabled manual automations the member can run: those opened by their role’s automation:update or by a link to that automation. No separate read key is needed. When nothing is runnable, the Actions button doesn’t render on the player page or in the server header on the Dashboard; the Players table’s row menu still opens, but lists No actions.

Grant access to an automation

1. Create a custom role first if you don’t have one yet (see Roles & permissions).
2. In Settings → Roles, edit the matrix and scroll down to the Automation actions group. Each manual automation you have created appears as a row labeled with the automation’s name.
3. Check the box where your custom role’s column meets that automation’s row.

To let a role run every manual automation instead, grant it Automations → Update in the matrix. That key is the automation-editing key as well, so hand it out only where editing is also intended.

Putting a teammate into a custom role

The role selector in the Members table and in the invite dialog offers your organization’s custom roles next to Admin, so a role you linked to specific automations can be given to a teammate directly. The selector reads the role catalog, so it lists custom roles only for someone who can view roles.

Automation actions group is hidden when no manual automations exist

The Automation actions group only appears in the matrix when at least one manual automation exists. If you see no such group, create a manual automation first.

See also

• Roles and permission keys reference
• Permissions model
• Player actions as automations
• Roles & permissions