Roles & permission keys

heliana gates every action behind a resource:action permission key — you’ll see these exact strings on the Roles screen when building a custom role. This page lists every key, grouped by feature area, and what each built-in role holds.

For the concepts behind the permission model see Permissions model and the Roles & permissions guide.

Permission keys

Audit log

Key	What it gates
`auditLog:read`	View the organization’s audit log

Bans

Key	What it gates
`ban:create`	Issue a ban against a player
`ban:read`	View bans on a player profile
`ban:update`	Edit a ban
`ban:delete`	Revoke (lift) a ban, and add or remove a ban exception on a player
`ban:import`	View the result of an external ban-source sync run. Starting a sync itself is gated by `roster:manage`.

Ban lists

Key	What it gates
`banList:read`	View exceptions on a player
`banList:manage`	Reserved for ban-list management not already covered by Roster or Bans

Roster (lists & groups)

Key	What it gates
`roster:read`	View roster groups and their members
`roster:manage`	Create/edit roster groups, add or remove members, connect and sync an external ban source into a group

Events

Key	What it gates
`event:read`	View the live feed widget on the Dashboard

Invitations

Key	What it gates
`invitation:create`	Send an invitation to join the organization
`invitation:cancel`	Cancel a pending invitation

Members

Key	What it gates
`member:create`	Add a member directly, without an invitation
`member:update`	Change a member’s role
`member:delete`	Remove a member from the organization

Notes

Key	What it gates
`note:create`	Add a note to a player profile
`note:read`	View notes on a player profile
`note:update`	Edit an existing note
`note:delete`	Delete a note

Organization

Key	What it gates
`organization:update`	Rename the organization or change org-level settings
`organization:delete`	Delete the entire organization

Players

Key	What it gates
`player:read`	View player profiles and activity history
`player:ip`	View a player’s recorded IP address

Roles

Key	What it gates
`role:create`	Create a custom role
`role:read`	View custom role definitions
`role:update`	Edit a custom role’s permissions
`role:delete`	Delete a custom role

Servers

Key	What it gates
`server:create`	Add a server to the organization
`server:read`	View server configuration
`server:update`	Edit server connection settings
`server:delete`	Remove a server from the organization

Triggers

Key	What it gates
`trigger:create`	Create a trigger
`trigger:read`	View trigger definitions and run history
`trigger:update`	Edit a trigger
`trigger:delete`	Delete a trigger

Per-trigger run key: `trigger:exec:<id>`

Every Manual trigger gets its own permission key the moment it’s created — trigger:exec:<trigger-id>. This is what gates the Run button for that specific trigger on a player or server card. It shows up as its own row in the custom role editor for every manual trigger in your organization.

The key survives renaming the trigger; deleting the trigger removes the key from any custom role that held it. Owner and Admin can always run any manual trigger, whether or not a role explicitly grants the key.

System roles

heliana ships four built-in roles. They can’t be edited or deleted.

Owner

Full control, including deleting the organization and managing who else can manage access. Typically the person who created the organization.

Resource	Grants
Audit log	read
Bans	create, read, update, delete, import
Ban lists	read, manage
Roster	read, manage
Events	read
Invitations	create, cancel
Members	create, update, delete
Notes	create, read, update, delete
Organization	update, delete
Players	read, view IP
Roles	create, read, update, delete
Servers	create, read, update, delete
Triggers	create, read, update, delete

Owner also has exclusive control over the organization’s advanced, per-member access settings — this is separate from the resource keys above and isn’t something Admin can touch.

Admin

Everything Owner has except deleting the organization and that advanced access-control layer.

Resource	Grants
Audit log	read
Bans	create, read, update, delete, import
Ban lists	read, manage
Roster	read, manage
Events	read
Invitations	create, cancel
Members	create, update, delete
Notes	create, read, update, delete
Organization	update
Players	read, view IP
Roles	create, read, update, delete
Servers	create, read, update, delete
Triggers	create, read, update, delete

Viewer

Read-only access to player data, bans, notes, roster, and triggers. Can’t modify anything.

Resource	Grants
Bans	read
Ban lists	read
Roster	read
Events	read
Notes	read
Players	read
Roles	read
Servers	read
Triggers	read

Viewer does not get auditLog:read, any invitation key, any member key, organization:update, or player:ip.

Clan leader

Read-only access to the roster — enough to see who’s in it, without exposing bans, players, or server data.

Resource	Grants
Roster	read

A clan leader’s ability to actually manage their own clan’s roster group comes from being set as that group’s leader, not from this role.

Custom roles

A custom role holds any subset of the static keys above, plus any trigger:exec:<id> keys for manual triggers that currently exist in your organization. The role editor presents the static keys as a checkbox matrix, with a separate section for the dynamic trigger-run keys. Only Owner grants organization:delete by default; a custom role can technically be configured to include it.