/snap/lxd/current/share/lxd-documentation/reference/permissions/ Current File: //snap/lxd/current/share/lxd-documentation/reference/permissions/index.html
<!doctype html>
<html class="no-js" lang="en" data-content_root="../../">
  <head><meta charset="utf-8"/>
    <meta name="viewport" content="width=device-width,initial-scale=1"/>
    <meta name="color-scheme" content="light dark"><meta name="viewport" content="width=device-width, initial-scale=1" />
<meta property="og:title" content="Permissions" />
<meta property="og:type" content="website" />
<meta property="og:url" content="https://documentation.ubuntu.com/lxd/latest/reference/permissions/" />
<meta property="og:site_name" content="LXD documentation" />
<meta property="og:description" content="When managing user access via Fine-grained authorization, you add identities to groups and then grant entitlements against specific LXD API resources to these groups. Each LXD API resource has a pa..." />
<meta property="og:image" content="https://documentation.ubuntu.com/lxd/latest/_static/tag.png" />
<meta property="og:image:alt" content="LXD documentation" />
<meta name="description" content="When managing user access via Fine-grained authorization, you add identities to groups and then grant entitlements against specific LXD API resources to these groups. Each LXD API resource has a pa..." />
<link rel="index" title="Index" href="../../genindex/" /><link rel="search" title="Search" href="../../search/" /><link rel="next" title="REST API" href="../../restapi_landing/" /><link rel="prev" title="Provided metrics" href="../provided_metrics/" />
        <link rel="canonical" href="https://documentation.ubuntu.com/lxd/reference/permissions/" />

    <link rel="shortcut icon" href="../../_static/favicon.ico"/><!-- Generated with Sphinx 8.2.3 and Furo 2025.07.19 -->
        <title>Permissions</title>
      <link rel="stylesheet" type="text/css" href="../../_static/pygments.css?v=d111a655" />
    <link rel="stylesheet" type="text/css" href="../../_static/styles/furo.css?v=25af2a20" />
    <link rel="stylesheet" type="text/css" href="../../_static/copybutton.css?v=76b2166b" />
    <link rel="stylesheet" type="text/css" href="../../_static/youtube.css" />
    <link rel="stylesheet" type="text/css" href="../../_static/related-links.css" />
    <link rel="stylesheet" type="text/css" href="../../_static/terminal-output.css" />
    <link rel="stylesheet" type="text/css" href="../../_static/config-options.css" />
    <link rel="stylesheet" type="text/css" href="../../_static/sphinx-design.min.css?v=95c83b7e" />
    <link rel="stylesheet" type="text/css" href="../../_static/styles/furo-extensions.css?v=8dab3a3b" />
    <link rel="stylesheet" type="text/css" href="../../_static/custom.css?v=66d86e9d" />
    <link rel="stylesheet" type="text/css" href="../../_static/header.css?v=84f70f09" />
    <link rel="stylesheet" type="text/css" href="../../_static/github_issue_links.css?v=af88fb93" />
    <link rel="stylesheet" type="text/css" href="../../_static/furo_colors.css?v=c4ccdb8a" />
    <link rel="stylesheet" type="text/css" href="../../_static/footer.css?v=bd05fc90" />
    <link rel="stylesheet" type="text/css" href="../../_static/cookie-banner.css?v=b74831ab" />
    
</head>
  <body>
    <header id="header" class="p-navigation">
  <script type="module" src="../../_static/js/bundle.js">
  </script>

  <!-- Google Tag Manager -->
  <script>
    (function(w, d, s, l, i) {
      w[l] = w[l] || [];
      w[l].push({
        'gtm.start': new Date().getTime(),
        event: 'gtm.js'
      });
      var f = d.getElementsByTagName(s)[0];
      var j = d.createElement(s);
      var dl = '';
      if (l != 'dataLayer') {
          dl = '&l=' + l;
      }
      j.async = true;
      j.src = 'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
      f.parentNode.insertBefore(j, f);
    })(window, document, 'script', 'dataLayer', 'GTM-KNX3CJC');
  </script>
  
  <div class="p-navigation__nav" role="menubar">

    <ul class="p-navigation__links" role="menu">

      <li>
        <a class="p-logo" href="https://canonical.com/lxd" aria-current="page">
          <img src="../../_static/tag.png" alt="Logo" class="p-logo-image">
          <div class="p-logo-text p-heading--4">LXD
          </div>
        </a>
      </li>

      <li class="nav-ubuntu-com">
        <a href="https://canonical.com/lxd" class="p-navigation__link">canonical.com/lxd</a>
      </li>

      <li>
        <a href="#" class="p-navigation__link nav-more-links">More resources</a>
        <ul class="more-links-dropdown">

          <li>
            <a href="https://ubuntu.com/lxd/install/" class="p-navigation__sub-link p-dropdown__link">Install LXD</a>
          </li>

          <li>
            <a href="https://ubuntu.com/lxd/manage/" class="p-navigation__sub-link p-dropdown__link">Manage LXD</a>
          </li>

          <li>
            <a href="https://discourse.ubuntu.com/c/lxd/" class="p-navigation__sub-link p-dropdown__link">Forum</a>
          </li>

          <li>
            <a href="https://github.com/canonical/lxd" class="p-navigation__sub-link p-dropdown__link">GitHub</a>
          </li>

        </ul>
      </li>

    </ul>
  </div>
</header>
   
    <script>
      document.body.dataset.theme = localStorage.getItem("theme") || "auto";
    </script>
    

<svg xmlns="http://www.w3.org/2000/svg" style="display: none;">
  <symbol id="svg-toc" viewBox="0 0 24 24">
    <title>Contents</title>
    <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 1024 1024">
      <path d="M408 442h480c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8H408c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8zm-8 204c0 4.4 3.6 8 8 8h480c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8H408c-4.4 0-8 3.6-8 8v56zm504-486H120c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h784c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8zm0 632H120c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h784c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8zM115.4 518.9L271.7 642c5.8 4.6 14.4.5 14.4-6.9V388.9c0-7.4-8.5-11.5-14.4-6.9L115.4 505.1a8.74 8.74 0 0 0 0 13.8z"/>
    </svg>
  </symbol>
  <symbol id="svg-menu" viewBox="0 0 24 24">
    <title>Menu</title>
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather-menu">
      <line x1="3" y1="12" x2="21" y2="12"></line>
      <line x1="3" y1="6" x2="21" y2="6"></line>
      <line x1="3" y1="18" x2="21" y2="18"></line>
    </svg>
  </symbol>
  <symbol id="svg-arrow-right" viewBox="0 0 24 24">
    <title>Expand</title>
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather-chevron-right">
      <polyline points="9 18 15 12 9 6"></polyline>
    </svg>
  </symbol>
  <symbol id="svg-sun" viewBox="0 0 24 24">
    <title>Light mode</title>
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="feather-sun">
      <circle cx="12" cy="12" r="5"></circle>
      <line x1="12" y1="1" x2="12" y2="3"></line>
      <line x1="12" y1="21" x2="12" y2="23"></line>
      <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line>
      <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line>
      <line x1="1" y1="12" x2="3" y2="12"></line>
      <line x1="21" y1="12" x2="23" y2="12"></line>
      <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line>
      <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line>
    </svg>
  </symbol>
  <symbol id="svg-moon" viewBox="0 0 24 24">
    <title>Dark mode</title>
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-tabler-moon">
      <path stroke="none" d="M0 0h24v24H0z" fill="none" />
      <path d="M12 3c.132 0 .263 0 .393 0a7.5 7.5 0 0 0 7.92 12.446a9 9 0 1 1 -8.313 -12.454z" />
    </svg>
  </symbol>
  <symbol id="svg-sun-with-moon" viewBox="0 0 24 24">
    <title>Auto light/dark, in light mode</title>
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="1" stroke-linecap="round" stroke-linejoin="round"
      class="icon-custom-derived-from-feather-sun-and-tabler-moon">
      <path style="opacity: 50%" d="M 5.411 14.504 C 5.471 14.504 5.532 14.504 5.591 14.504 C 3.639 16.319 4.383 19.569 6.931 20.352 C 7.693 20.586 8.512 20.551 9.25 20.252 C 8.023 23.207 4.056 23.725 2.11 21.184 C 0.166 18.642 1.702 14.949 4.874 14.536 C 5.051 14.512 5.231 14.5 5.411 14.5 L 5.411 14.504 Z"/>
      <line x1="14.5" y1="3.25" x2="14.5" y2="1.25"/>
      <line x1="14.5" y1="15.85" x2="14.5" y2="17.85"/>
      <line x1="10.044" y1="5.094" x2="8.63" y2="3.68"/>
      <line x1="19" y1="14.05" x2="20.414" y2="15.464"/>
      <line x1="8.2" y1="9.55" x2="6.2" y2="9.55"/>
      <line x1="20.8" y1="9.55" x2="22.8" y2="9.55"/>
      <line x1="10.044" y1="14.006" x2="8.63" y2="15.42"/>
      <line x1="19" y1="5.05" x2="20.414" y2="3.636"/>
      <circle cx="14.5" cy="9.55" r="3.6"/>
    </svg>
  </symbol>
  <symbol id="svg-moon-with-sun" viewBox="0 0 24 24">
    <title>Auto light/dark, in dark mode</title>
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="1" stroke-linecap="round" stroke-linejoin="round"
      class="icon-custom-derived-from-feather-sun-and-tabler-moon">
      <path d="M 8.282 7.007 C 8.385 7.007 8.494 7.007 8.595 7.007 C 5.18 10.184 6.481 15.869 10.942 17.24 C 12.275 17.648 13.706 17.589 15 17.066 C 12.851 22.236 5.91 23.143 2.505 18.696 C -0.897 14.249 1.791 7.786 7.342 7.063 C 7.652 7.021 7.965 7 8.282 7 L 8.282 7.007 Z"/>
      <line style="opacity: 50%" x1="18" y1="3.705" x2="18" y2="2.5"/>
      <line style="opacity: 50%" x1="18" y1="11.295" x2="18" y2="12.5"/>
      <line style="opacity: 50%" x1="15.316" y1="4.816" x2="14.464" y2="3.964"/>
      <line style="opacity: 50%" x1="20.711" y1="10.212" x2="21.563" y2="11.063"/>
      <line style="opacity: 50%" x1="14.205" y1="7.5" x2="13.001" y2="7.5"/>
      <line style="opacity: 50%" x1="21.795" y1="7.5" x2="23" y2="7.5"/>
      <line style="opacity: 50%" x1="15.316" y1="10.184" x2="14.464" y2="11.036"/>
      <line style="opacity: 50%" x1="20.711" y1="4.789" x2="21.563" y2="3.937"/>
      <circle style="opacity: 50%" cx="18" cy="7.5" r="2.169"/>
    </svg>
  </symbol>
  <symbol id="svg-pencil" viewBox="0 0 24 24">
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-tabler-pencil-code">
      <path d="M4 20h4l10.5 -10.5a2.828 2.828 0 1 0 -4 -4l-10.5 10.5v4" />
      <path d="M13.5 6.5l4 4" />
      <path d="M20 21l2 -2l-2 -2" />
      <path d="M17 17l-2 2l2 2" />
    </svg>
  </symbol>
  <symbol id="svg-eye" viewBox="0 0 24 24">
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor"
      stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-tabler-eye-code">
      <path stroke="none" d="M0 0h24v24H0z" fill="none" />
      <path d="M10 12a2 2 0 1 0 4 0a2 2 0 0 0 -4 0" />
      <path
        d="M11.11 17.958c-3.209 -.307 -5.91 -2.293 -8.11 -5.958c2.4 -4 5.4 -6 9 -6c3.6 0 6.6 2 9 6c-.21 .352 -.427 .688 -.647 1.008" />
      <path d="M20 21l2 -2l-2 -2" />
      <path d="M17 17l-2 2l2 2" />
    </svg>
  </symbol>
</svg>

<input type="checkbox" class="sidebar-toggle" name="__navigation" id="__navigation">
<input type="checkbox" class="sidebar-toggle" name="__toc" id="__toc">
<label class="overlay sidebar-overlay" for="__navigation">
  <div class="visually-hidden">Hide navigation sidebar</div>
</label>
<label class="overlay toc-overlay" for="__toc">
  <div class="visually-hidden">Hide table of contents sidebar</div>
</label>

<a class="skip-to-content muted-link" href="#furo-main-content">Skip to content</a>



<div class="page">
  <header class="mobile-header">
    <div class="header-left">
      <label class="nav-overlay-icon" for="__navigation">
        <div class="visually-hidden">Toggle site navigation sidebar</div>
        <i class="icon"><svg><use href="#svg-menu"></use></svg></i>
      </label>
    </div>
    <div class="header-center">
      <a href="../../"><div class="brand">LXD</div></a>
    </div>
    <div class="header-right">
      <div class="theme-toggle-container theme-toggle-header">
        <button class="theme-toggle">
          <div class="visually-hidden">Toggle Light / Dark / Auto color theme</div>
          <svg class="theme-icon-when-auto-light"><use href="#svg-sun-with-moon"></use></svg>
          <svg class="theme-icon-when-auto-dark"><use href="#svg-moon-with-sun"></use></svg>
          <svg class="theme-icon-when-dark"><use href="#svg-moon"></use></svg>
          <svg class="theme-icon-when-light"><use href="#svg-sun"></use></svg>
        </button>
      </div>
      <label class="toc-overlay-icon toc-header-icon" for="__toc">
        <div class="visually-hidden">Toggle table of contents sidebar</div>
        <i class="icon"><svg><use href="#svg-toc"></use></svg></i>
      </label>
    </div>
  </header>
  <aside class="sidebar-drawer">
    <div class="sidebar-container">
      
      <div class="sidebar-sticky"><a class="sidebar-brand" href="../../">
  
  
</a><form class="sidebar-search-container" method="get" action="../../search/" role="search">
    <input class="sidebar-search" placeholder="Search" name="q" aria-label="Search">
    <input type="submit" value="Go">
    <input type="hidden" name="check_keywords" value="yes">
    <input type="hidden" name="area" value="default">
  </form>
  <div id="searchbox"></div><div class="sidebar-scroll"><div class="sidebar-tree">
  <ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../">LXD</a></li>
<li class="toctree-l1 has-children"><a class="reference internal" href="../../tutorial/">Tutorials</a><input class="toctree-checkbox" id="toctree-checkbox-1" name="toctree-checkbox-1" role="switch" type="checkbox"/><label for="toctree-checkbox-1"><div class="visually-hidden">Toggle navigation of Tutorials</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l2"><a class="reference internal" href="../../tutorial/first_steps/">First steps with LXD</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../tutorial/ui/">Getting started with the UI</a></li>
</ul>
</li>
<li class="toctree-l1 has-children"><a class="reference internal" href="../../howto/">How-to guides</a><input class="toctree-checkbox" id="toctree-checkbox-2" name="toctree-checkbox-2" role="switch" type="checkbox"/><label for="toctree-checkbox-2"><div class="visually-hidden">Toggle navigation of How-to guides</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../getting_started/">Getting started</a><input class="toctree-checkbox" id="toctree-checkbox-3" name="toctree-checkbox-3" role="switch" type="checkbox"/><label for="toctree-checkbox-3"><div class="visually-hidden">Toggle navigation of Getting started</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../installing/">Install LXD</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/initialize/">Initialize LXD</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/access_ui/">Access the UI</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/access_documentation/">Access documentation locally</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../operation/">LXD server and client</a><input class="toctree-checkbox" id="toctree-checkbox-4" name="toctree-checkbox-4" role="switch" type="checkbox"/><label for="toctree-checkbox-4"><div class="visually-hidden">Toggle navigation of LXD server and client</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/server_expose/">Expose LXD to the network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/server_configure/">Configure the LXD server</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/oidc_auth0/">Configure OIDC authentication with Auth0</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/oidc_ory/">Configure OIDC authentication with Ory Hydra</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/oidc_keycloak/">Configure OIDC authentication with Keycloak</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/oidc_entra_id/">Configure OIDC authentication with Microsoft Entra ID</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../remotes/">Add remote servers</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/lxc_alias/">Add command aliases</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../instances/">Instances</a><input class="toctree-checkbox" id="toctree-checkbox-5" name="toctree-checkbox-5" role="switch" type="checkbox"/><label for="toctree-checkbox-5"><div class="visually-hidden">Toggle navigation of Instances</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_create/">Create instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_configure/">Configure instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_manage/">Manage instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../profiles/">Use profiles</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_troubleshoot/">Troubleshoot errors</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_ubuntu_pro_attach/">Auto attach Ubuntu Pro</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_access_files/">Access files</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_console/">Access the console</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../instance-exec/">Run commands</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../cloud-init/">Use cloud-init</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_routed_nic_vm/">Add a routed NIC to a VM</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_backup/">Back up instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_migrate/">Migrate instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/import_machines_to_instances/">Import existing machines</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/container_gpu_passthrough_with_docker/">Pass NVIDIA GPUs</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../images/">Images</a><input class="toctree-checkbox" id="toctree-checkbox-6" name="toctree-checkbox-6" role="switch" type="checkbox"/><label for="toctree-checkbox-6"><div class="visually-hidden">Toggle navigation of Images</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/images_remote/">Use remote images</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/images_manage/">Manage images</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/images_profiles/">Associate profiles</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/images_copy/">Copy and import images</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/images_create/">Create images</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../projects/">Projects</a><input class="toctree-checkbox" id="toctree-checkbox-7" name="toctree-checkbox-7" role="switch" type="checkbox"/><label for="toctree-checkbox-7"><div class="visually-hidden">Toggle navigation of Projects</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/projects_create/">Create and configure</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/projects_work/">Work with projects</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/projects_confine/">Confine users to projects</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../storage/">Storage</a><input class="toctree-checkbox" id="toctree-checkbox-8" name="toctree-checkbox-8" role="switch" type="checkbox"/><label for="toctree-checkbox-8"><div class="visually-hidden">Toggle navigation of Storage</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/storage_pools/">Manage pools</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/storage_volumes/">Manage volumes</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/storage_buckets/">Manage buckets</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/storage_create_instance/">Create an instance in a pool</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/storage_backup_volume/">Back up a volume</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/storage_move_volume/">Move or copy a volume</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../networks/">Networking</a><input class="toctree-checkbox" id="toctree-checkbox-9" name="toctree-checkbox-9" role="switch" type="checkbox"/><label for="toctree-checkbox-9"><div class="visually-hidden">Toggle navigation of Networking</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_create/">Create a network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_configure/">Configure a network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_bgp/">Configure as BGP server</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_acls/">Configure network ACLs</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_forwards/">Configure forwards</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_zones/">Configure network zones</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_bridge_firewalld/">Configure your firewall</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_bridge_resolved/">Integrate with resolved</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_ovn_setup/">Set up OVN</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_load_balancers/">Configure load balancers</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_ovn_peers/">Configure peer routing</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_ipam/">Display IPAM information</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../clustering/">Clustering</a><input class="toctree-checkbox" id="toctree-checkbox-10" name="toctree-checkbox-10" role="switch" type="checkbox"/><label for="toctree-checkbox-10"><div class="visually-hidden">Toggle navigation of Clustering</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_form/">Form a cluster</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_manage/">Manage a cluster</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_config_networks/">Configure networks</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_config_storage/">Configure storage</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_manage_instance/">Manage instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_groups/">Set up cluster groups</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/cluster_recover/">Recover a cluster</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../production-setup/">Production setup</a><input class="toctree-checkbox" id="toctree-checkbox-11" name="toctree-checkbox-11" role="switch" type="checkbox"/><label for="toctree-checkbox-11"><div class="visually-hidden">Toggle navigation of Production setup</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/benchmark_performance/">Benchmark performance</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_increase_bandwidth/">Increase bandwidth</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../metrics/">Monitor metrics</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/logs_loki/">Send logs to Loki</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/grafana/">Set up Grafana</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../backup/">Back up a server</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/disaster_recovery/">Recover instances</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../howto/snap/">Manage the snap</a></li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../howto/troubleshoot/">Troubleshooting</a><input class="toctree-checkbox" id="toctree-checkbox-12" name="toctree-checkbox-12" role="switch" type="checkbox"/><label for="toctree-checkbox-12"><div class="visually-hidden">Toggle navigation of Troubleshooting</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../howto/network_bridge_firewalld/">Configure your firewall</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/instances_troubleshoot/">Troubleshoot instances</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../howto/dqlite_troubleshoot/">Troubleshoot Dqlite</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../debugging/">Debug LXD</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../faq/">Frequently asked</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../support/">Get support</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../contributing/">Contribute to LXD</a></li>
</ul>
</li>
<li class="toctree-l1 has-children"><a class="reference internal" href="../../explanation/">Explanation</a><input class="toctree-checkbox" id="toctree-checkbox-13" name="toctree-checkbox-13" role="switch" type="checkbox"/><label for="toctree-checkbox-13"><div class="visually-hidden">Toggle navigation of Explanation</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/lxd_lxc/"><code class="docutils literal notranslate"><span class="pre">lxd</span></code> and <code class="docutils literal notranslate"><span class="pre">lxc</span></code></a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/instances/">Containers and VMs</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../image-handling/">Local and remote images</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/storage/">Storage pools, volumes, and buckets</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/networks/">Networking setups</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../database/">The LXD Dqlite database</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/lxc_show_info/"><code class="docutils literal notranslate"><span class="pre">lxc</span></code> <code class="docutils literal notranslate"><span class="pre">show</span></code> and <code class="docutils literal notranslate"><span class="pre">info</span></code></a></li>
<li class="toctree-l2"><a class="reference internal" href="../../authentication/">Remote API authentication</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/authorization/">Remote API authorization</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/projects/">Instances grouping with projects</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/clusters/">Clusters</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/performance_tuning/">Performance tuning</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/security/">Security</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../explanation/bpf/">Privilege delegation using BPF Token</a></li>
</ul>
</li>
<li class="toctree-l1 current has-children"><a class="reference internal" href="../">Reference</a><input checked="" class="toctree-checkbox" id="toctree-checkbox-14" name="toctree-checkbox-14" role="switch" type="checkbox"/><label for="toctree-checkbox-14"><div class="visually-hidden">Toggle navigation of Reference</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../../requirements/">Requirements</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../architectures/">Architectures</a></li>
<li class="toctree-l2"><a class="reference internal" href="../releases-snap/">Releases and snap</a></li>
<li class="toctree-l2"><a class="reference internal" href="../remote_image_servers/">Remote image servers</a></li>
<li class="toctree-l2"><a class="reference internal" href="../image_format/">Image format</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../guest-os-compatibility/">Guest OS compatibility</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../container-environment/">Container environment</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../config-options/">Configuration option index</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../server/">Server configuration</a></li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../explanation/instance_config/">Instance configuration</a><input class="toctree-checkbox" id="toctree-checkbox-15" name="toctree-checkbox-15" role="switch" type="checkbox"/><label for="toctree-checkbox-15"><div class="visually-hidden">Toggle navigation of Instance configuration</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../instance_properties/">Instance properties</a></li>
<li class="toctree-l3"><a class="reference internal" href="../instance_options/">Instance options</a></li>
<li class="toctree-l3 has-children"><a class="reference internal" href="../devices/">Devices</a><input class="toctree-checkbox" id="toctree-checkbox-16" name="toctree-checkbox-16" role="switch" type="checkbox"/><label for="toctree-checkbox-16"><div class="visually-hidden">Toggle navigation of Devices</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l4"><a class="reference internal" href="../standard_devices/">Standard devices</a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_none/">Type: <code class="docutils literal notranslate"><span class="pre">none</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_nic/">Type: <code class="docutils literal notranslate"><span class="pre">nic</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_disk/">Type: <code class="docutils literal notranslate"><span class="pre">disk</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_unix_char/">Type: <code class="docutils literal notranslate"><span class="pre">unix-char</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_unix_block/">Type: <code class="docutils literal notranslate"><span class="pre">unix-block</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_usb/">Type: <code class="docutils literal notranslate"><span class="pre">usb</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_gpu/">Type: <code class="docutils literal notranslate"><span class="pre">gpu</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_infiniband/">Type: <code class="docutils literal notranslate"><span class="pre">infiniband</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_proxy/">Type: <code class="docutils literal notranslate"><span class="pre">proxy</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_unix_hotplug/">Type: <code class="docutils literal notranslate"><span class="pre">unix-hotplug</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_tpm/">Type: <code class="docutils literal notranslate"><span class="pre">tpm</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="../devices_pci/">Type: <code class="docutils literal notranslate"><span class="pre">pci</span></code></a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="../instance_units/">Units for storage and network limits</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../preseed_yaml_fields/">Preseed YAML file fields</a></li>
<li class="toctree-l2"><a class="reference internal" href="../projects/">Project configuration</a></li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../storage_drivers/">Storage drivers</a><input class="toctree-checkbox" id="toctree-checkbox-17" name="toctree-checkbox-17" role="switch" type="checkbox"/><label for="toctree-checkbox-17"><div class="visually-hidden">Toggle navigation of Storage drivers</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../storage_btrfs/">Btrfs - <code class="docutils literal notranslate"><span class="pre">btrfs</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_cephfs/">CephFS - <code class="docutils literal notranslate"><span class="pre">cephfs</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_cephobject/">Ceph Object - <code class="docutils literal notranslate"><span class="pre">cephobject</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_ceph/">Ceph RBD - <code class="docutils literal notranslate"><span class="pre">ceph</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_powerflex/">Dell PowerFlex - <code class="docutils literal notranslate"><span class="pre">powerflex</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_pure/">Pure Storage - <code class="docutils literal notranslate"><span class="pre">pure</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_dir/">Directory - <code class="docutils literal notranslate"><span class="pre">dir</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_lvm/">LVM - <code class="docutils literal notranslate"><span class="pre">lvm</span></code></a></li>
<li class="toctree-l3"><a class="reference internal" href="../storage_zfs/">ZFS - <code class="docutils literal notranslate"><span class="pre">zfs</span></code></a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../networks/">Networks</a><input class="toctree-checkbox" id="toctree-checkbox-18" name="toctree-checkbox-18" role="switch" type="checkbox"/><label for="toctree-checkbox-18"><div class="visually-hidden">Toggle navigation of Networks</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../network_bridge/">Bridge network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../network_ovn/">OVN network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../network_macvlan/">Macvlan network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../network_physical/">Physical network</a></li>
<li class="toctree-l3"><a class="reference internal" href="../network_sriov/">SR-IOV network</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../cluster_member_config/">Cluster configuration</a></li>
<li class="toctree-l2"><a class="reference internal" href="../server_settings/">Production server settings</a></li>
<li class="toctree-l2"><a class="reference internal" href="../provided_metrics/">Provided metrics</a></li>
<li class="toctree-l2 current current-page"><a class="current reference internal" href="#">Permissions</a></li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../restapi_landing/">REST API</a><input class="toctree-checkbox" id="toctree-checkbox-19" name="toctree-checkbox-19" role="switch" type="checkbox"/><label for="toctree-checkbox-19"><div class="visually-hidden">Toggle navigation of REST API</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../rest-api/">Main API documentation</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../api/">Main API specification</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../api-extensions/">Main API extensions</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../events/">Events API documentation</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../dev-lxd/">Instance API</a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../manpages/">Man pages</a><input class="toctree-checkbox" id="toctree-checkbox-20" name="toctree-checkbox-20" role="switch" type="checkbox"/><label for="toctree-checkbox-20"><div class="visually-hidden">Toggle navigation of Man pages</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../manpages/lxc/"><code class="docutils literal notranslate"><span class="pre">lxc</span></code></a></li>
</ul>
</li>
<li class="toctree-l2 has-children"><a class="reference internal" href="../../internals/">Internals</a><input class="toctree-checkbox" id="toctree-checkbox-21" name="toctree-checkbox-21" role="switch" type="checkbox"/><label for="toctree-checkbox-21"><div class="visually-hidden">Toggle navigation of Internals</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul>
<li class="toctree-l3"><a class="reference internal" href="../../environment/">Environment variables</a></li>
<li class="toctree-l3"><a class="reference internal" href="../uefi_variables/">UEFI variables for VMs</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../daemon-behavior/">Daemon behavior</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../syscall-interception/">System call interception</a></li>
<li class="toctree-l3"><a class="reference internal" href="../../userns-idmap/">User namespace setup</a></li>
<li class="toctree-l3"><a class="reference internal" href="../ovn-internals/">OVN implementation</a></li>
<li class="toctree-l3"><a class="reference internal" href="../vm_live_migration_internals/">VM live migration implementation</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference external" href="https://github.com/canonical/lxd">Project repository</a></li>
<li class="toctree-l2"><a class="reference external" href="https://images.lxd.canonical.com">Image server</a></li>
</ul>
</li>
</ul>

</div>
</div>

      </div>
      
    </div>
  </aside>
  <div class="main">
    <div class="content">
      <div class="article-container">
        <a href="#" class="back-to-top muted-link">
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
            <path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8v12z"></path>
          </svg>
          <span>Back to top</span>
        </a>
        <div class="content-icon-container">
          <div class="view-this-page">
  <a class="muted-link" href="../../_sources/reference/permissions.md.txt" title="View this page">
    <svg><use href="#svg-eye"></use></svg>
    <span class="visually-hidden">View this page</span>
  </a>
</div>
<div class="theme-toggle-container theme-toggle-content">
            <button class="theme-toggle">
              <div class="visually-hidden">Toggle Light / Dark / Auto color theme</div>
              <svg class="theme-icon-when-auto-light"><use href="#svg-sun-with-moon"></use></svg>
              <svg class="theme-icon-when-auto-dark"><use href="#svg-moon-with-sun"></use></svg>
              <svg class="theme-icon-when-dark"><use href="#svg-moon"></use></svg>
              <svg class="theme-icon-when-light"><use href="#svg-sun"></use></svg>
            </button>
          </div>
          <label class="toc-overlay-icon toc-content-icon" for="__toc">
            <div class="visually-hidden">Toggle table of contents sidebar</div>
            <i class="icon"><svg><use href="#svg-toc"></use></svg></i>
          </label>
        </div>
        <article role="main" id="furo-main-content">
          <section id="permissions">
<span id="permissions-reference"></span><h1>Permissions<a class="headerlink" href="#permissions" title="Link to this heading">¶</a></h1>
<p>When managing user access via <a class="reference internal" href="../../explanation/authorization/#fine-grained-authorization"><span class="std std-ref">Fine-grained authorization</span></a>, you add identities to groups and then grant entitlements against specific LXD API resources to these groups.</p>
<p>Each LXD API resource has a particular entity type, and each entity type has a set of entitlements that can be granted against API resources of that type.</p>
<p>Below is a description of each entity type, and a list of entitlements that can be granted against entities of that type.</p>
<section id="server">
<h2>Server<a class="headerlink" href="#server" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">server</span></code></p>
</div></blockquote>
<p>The <code class="docutils literal notranslate"><span class="pre">server</span></code> entity type is the top-level entity type for the LXD system.
Entitlements that are granted at this level might cascade to projects and other resources:</p>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">admin</span></code></dt><dd><p>Grants full access to LXD as if via Unix socket.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">viewer</span></code></dt><dd><p>Grants access to view all resources in the LXD server.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit server configuration, to edit cluster member configuration, to update the state of a cluster member, to create, edit, and delete cluster groups, to update cluster member certificates, and to edit or delete warnings.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">permission_manager</span></code></dt><dd><p>Grants permission to view permissions, to create, edit, and delete identities, to view, create, edit, and delete authorization groups, and to view, create, edit, and delete identity provider groups. Note that clients with this permission are able to elevate their own privileges.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_permissions</span></code></dt><dd><p>Grants permission to view permissions.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_identities</span></code></dt><dd><p>Grants permission to create identities.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_identities</span></code></dt><dd><p>Grants permission to view identities.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_identities</span></code></dt><dd><p>Grants permission to edit identities.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_identities</span></code></dt><dd><p>Grants permission to delete identities.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_groups</span></code></dt><dd><p>Grants permission to create authorization groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_groups</span></code></dt><dd><p>Grants permission to view authorization groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_groups</span></code></dt><dd><p>Grants permission to edit authorization groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_groups</span></code></dt><dd><p>Grants permission to delete authorization groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_identity_provider_groups</span></code></dt><dd><p>Grants permission to create identity provider groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_identity_provider_groups</span></code></dt><dd><p>Grants permission to view identity provider groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_identity_provider_groups</span></code></dt><dd><p>Grants permission to edit identity provider groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_identity_provider_groups</span></code></dt><dd><p>Grants permission to delete identity provider groups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">storage_pool_manager</span></code></dt><dd><p>Grants permission to create, edit, and delete storage pools.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_storage_pools</span></code></dt><dd><p>Grants permission to create storage pools.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_storage_pools</span></code></dt><dd><p>Grants permission to edit storage pools.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_storage_pools</span></code></dt><dd><p>Grants permission to delete storage pools.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">project_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete projects, and to create, view, edit, and delete resources belonging to any project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_projects</span></code></dt><dd><p>Grants permission to create projects.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_projects</span></code></dt><dd><p>Grants permission to view projects, and all resources within those projects.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_projects</span></code></dt><dd><p>Grants permission to edit projects, and all resources within those projects.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_projects</span></code></dt><dd><p>Grants permission to delete projects.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_override_cluster_target_restriction</span></code></dt><dd><p>If a project is configured with <code class="docutils literal notranslate"><span class="pre">restricted.cluster.target</span></code>, clients with this permission can override the restriction.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_privileged_events</span></code></dt><dd><p>Grants permission to view privileged event types, such as logging events.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_resources</span></code></dt><dd><p>Grants permission to view server and storage pool resource usage information.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_metrics</span></code></dt><dd><p>Grants permission to view all server and project level metrics.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_warnings</span></code></dt><dd><p>Grants permission to view warnings.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_unmanaged_networks</span></code></dt><dd><p>Grants permission to view unmanaged networks on the LXD host machines.</p>
</dd>
</dl>
</section>
<section id="project">
<h2>Project<a class="headerlink" href="#project" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">project</span></code></p>
</div></blockquote>
<p>Entitlements that are granted at the <code class="docutils literal notranslate"><span class="pre">project</span></code> level might cascade to project specific resources (such as instances):</p>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">operator</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all resources belonging to the project, but does not grant permission to edit the project configuration itself.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">viewer</span></code></dt><dd><p>Grants permission to view all resources belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">image_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all images belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_images</span></code></dt><dd><p>Grants permission to create images.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_images</span></code></dt><dd><p>Grants permission to view images.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_images</span></code></dt><dd><p>Grants permission to edit images.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_images</span></code></dt><dd><p>Grants permission to delete images.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">image_alias_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all image aliases belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_image_aliases</span></code></dt><dd><p>Grants permission to create image aliases.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_image_aliases</span></code></dt><dd><p>Grants permission to view image aliases.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_image_aliases</span></code></dt><dd><p>Grants permission to edit image aliases.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_image_aliases</span></code></dt><dd><p>Grants permission to delete image aliases.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">instance_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all instances belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_instances</span></code></dt><dd><p>Grants permission to create instances.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_instances</span></code></dt><dd><p>Grants permission to view instances.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_instances</span></code></dt><dd><p>Grants permission to edit instances.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_instances</span></code></dt><dd><p>Grants permission to delete instances.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_operate_instances</span></code></dt><dd><p>Grants permission to view instances, manage their state, manage their snapshots and backups, start terminal or console sessions, and access their files.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">network_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all networks belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_networks</span></code></dt><dd><p>Grants permission to create networks.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_networks</span></code></dt><dd><p>Grants permission to view networks.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_networks</span></code></dt><dd><p>Grants permission to edit networks.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_networks</span></code></dt><dd><p>Grants permission to delete networks.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">network_acl_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all network ACLs belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_network_acls</span></code></dt><dd><p>Grants permission to create network ACLs.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_network_acls</span></code></dt><dd><p>Grants permission to view network ACLs.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_network_acls</span></code></dt><dd><p>Grants permission to edit network ACLs.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_network_acls</span></code></dt><dd><p>Grants permission to delete network ACLs.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">network_zone_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all network zones belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_network_zones</span></code></dt><dd><p>Grants permission to create network zones.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_network_zones</span></code></dt><dd><p>Grants permission to view network zones.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_network_zones</span></code></dt><dd><p>Grants permission to edit network zones.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_network_zones</span></code></dt><dd><p>Grants permission to delete network zones.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">profile_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all profiles belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_profiles</span></code></dt><dd><p>Grants permission to create profiles.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_profiles</span></code></dt><dd><p>Grants permission to view profiles.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_profiles</span></code></dt><dd><p>Grants permission to edit profiles.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_profiles</span></code></dt><dd><p>Grants permission to delete profiles.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">storage_volume_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all storage volumes belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_storage_volumes</span></code></dt><dd><p>Grants permission to create storage volumes.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_storage_volumes</span></code></dt><dd><p>Grants permission to view storage volumes.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_storage_volumes</span></code></dt><dd><p>Grants permission to edit storage volumes.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_storage_volumes</span></code></dt><dd><p>Grants permission to delete storage volumes.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">storage_bucket_manager</span></code></dt><dd><p>Grants permission to create, view, edit, and delete all storage buckets belonging to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_create_storage_buckets</span></code></dt><dd><p>Grants permission to create storage buckets.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_storage_buckets</span></code></dt><dd><p>Grants permission to view storage buckets.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit_storage_buckets</span></code></dt><dd><p>Grants permission to edit storage buckets.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete_storage_buckets</span></code></dt><dd><p>Grants permission to delete storage buckets.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_operations</span></code></dt><dd><p>Grants permission to view operations relating to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_events</span></code></dt><dd><p>Grants permission to view events relating to the project.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view_metrics</span></code></dt><dd><p>Grants permission to view project level metrics.</p>
</dd>
</dl>
</section>
<section id="storage-pool">
<h2>Storage pool<a class="headerlink" href="#storage-pool" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">storage_pool</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the storage pool.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the storage pool.</p>
</dd>
</dl>
</section>
<section id="identity">
<h2>Identity<a class="headerlink" href="#identity" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">identity</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the identity.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the identity.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the identity.</p>
</dd>
</dl>
</section>
<section id="group">
<h2>Group<a class="headerlink" href="#group" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">group</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the group. Identities can always view groups that they are a member of.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the group.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the group.</p>
</dd>
</dl>
</section>
<section id="identity-provider-group">
<h2>Identity provider group<a class="headerlink" href="#identity-provider-group" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">identity_provider_group</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the identity provider group.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the identity provider group.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the identity provider group.</p>
</dd>
</dl>
</section>
<section id="certificate">
<h2>Certificate<a class="headerlink" href="#certificate" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">certificate</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the certificate.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the certificate.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the certificate.</p>
</dd>
</dl>
</section>
<section id="instance">
<h2>Instance<a class="headerlink" href="#instance" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">instance</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">user</span></code></dt><dd><p>Grants permission to view the instance, to access files, and to start a terminal or console session.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">operator</span></code></dt><dd><p>Grants permission to view the instance, to access files, start a terminal or console session, and to manage snapshots and backups.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the instance.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the instance.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the instance and any snapshots or backups it might have.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_update_state</span></code></dt><dd><p>Grants permission to change the instance state.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_manage_snapshots</span></code></dt><dd><p>Grants permission to create and delete snapshots of the instance.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_manage_backups</span></code></dt><dd><p>Grants permission to create and delete backups of the instance.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_connect_sftp</span></code></dt><dd><p>Grants permission to get an SFTP client for the instance.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_access_files</span></code></dt><dd><p>Grants permission to push or pull files into or out of the instance.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_access_console</span></code></dt><dd><p>Grants permission to start a console session.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_exec</span></code></dt><dd><p>Grants permission to start a terminal session.</p>
</dd>
</dl>
</section>
<section id="image">
<h2>Image<a class="headerlink" href="#image" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">image</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the image.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the image.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the image.</p>
</dd>
</dl>
</section>
<section id="image-alias">
<h2>Image alias<a class="headerlink" href="#image-alias" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">image_alias</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the image alias.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the image alias.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the image alias.</p>
</dd>
</dl>
</section>
<section id="network">
<h2>Network<a class="headerlink" href="#network" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">network</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the network.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the network.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the network.</p>
</dd>
</dl>
</section>
<section id="network-acl">
<h2>Network ACL<a class="headerlink" href="#network-acl" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">network_acl</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the network ACL.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the network ACL.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the network ACL.</p>
</dd>
</dl>
</section>
<section id="network-zone">
<h2>Network zone<a class="headerlink" href="#network-zone" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">network_zone</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the network zone.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the network zone.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the network zone.</p>
</dd>
</dl>
</section>
<section id="profile">
<h2>Profile<a class="headerlink" href="#profile" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">profile</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the profile.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the profile.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the profile.</p>
</dd>
</dl>
</section>
<section id="storage-volume">
<h2>Storage volume<a class="headerlink" href="#storage-volume" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">storage_volume</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the storage volume.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the storage volume.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the storage volume and any snapshots or backups it might have.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_manage_snapshots</span></code></dt><dd><p>Grants permission to create and delete snapshots of the storage volume.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_manage_backups</span></code></dt><dd><p>Grants permission to create and delete backups of the storage volume.</p>
</dd>
</dl>
</section>
<section id="storage-bucket">
<h2>Storage bucket<a class="headerlink" href="#storage-bucket" title="Link to this heading">¶</a></h2>
<blockquote>
<div><p>Entity type name: <code class="docutils literal notranslate"><span class="pre">storage_bucket</span></code></p>
</div></blockquote>
<dl class="simple myst">
<dt><code class="docutils literal notranslate"><span class="pre">can_edit</span></code></dt><dd><p>Grants permission to edit the storage bucket.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_delete</span></code></dt><dd><p>Grants permission to delete the storage bucket.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">can_view</span></code></dt><dd><p>Grants permission to view the storage bucket.</p>
</dd>
</dl>
</section>
</section>

        </article>
      </div>
      <footer>
        
   

<div class="related-pages">
  
  
      
  
  
  <a class="next-page" href="../../restapi_landing/">
        <div class="page-info">
          <div class="context">
            <span>Next</span>
          </div>
          <div class="title">REST API</div>
        </div>
        <svg class="furo-related-icon"><use href="#svg-arrow-right"></use></svg>
      </a>
    <a class="prev-page" href="../provided_metrics/">
        <svg class="furo-related-icon"><use href="#svg-arrow-right"></use></svg>
        <div class="page-info">
          <div class="context">
            <span>Previous</span>
          </div>
          
            <div class="title">Provided metrics</div>
          
        </div>
      </a>
</div>
<div class="bottom-of-page">
  <div class="left-details">
    <div class="copyright">
        Copyright &#169; 2014-2025 LXD contributors
    </div>

    <div class="last-updated">
      Last updated on Sep 08, 2025</div>
    <div class="show-source">
      <a class="muted-link" href="../../_sources/reference/permissions.md.txt"
         rel="nofollow">Show source</a>
    </div>
  </div>
  <div>
    
        
        
          
              <a class="display-contributors">Thanks to our contributor!</a>
          
          <div id="overlay"></div>
          <ul class="all-contributors">
              
                  <li>
                      <a href="https://github.com/canonical/lxd/commit/39cd0562ee0c62ed15723d718978a7aa087cec35" class="contributor">Mark Laing</a>
                  </li>
              
          </ul>
        
    
  </div>
  <div class="right-details">

    

    
    <div class="ask-discourse">
      <a class="muted-link" href="https://discourse.ubuntu.com/c/lxd/">Ask a question on Discourse</a>
    </div>
    

    

    
    <div class="ask-matrix">
      <a class="muted-link" href="https://matrix.to/#/#documentation:ubuntu.com">Ask a question on Matrix</a>
    </div>
    

    

    
    <div class="issue-github">
      <a class="muted-link" href="https://github.com/canonical/lxd/issues/new?title=doc%3A+ADD+A+TITLE&body=DESCRIBE+THE+ISSUE%0A%0A---%0ADocument: reference/permissions.md">Open a GitHub issue for this page</a>
    </div>
    

    <div class="edit-github">
      <a class="muted-link" href="https://github.com/canonical/lxd/edit/main/doc/reference/permissions.md">Edit this page on GitHub</a>
    </div>
    


    </div>
  </div>
</div>

      </footer>
    </div>
    <aside class="toc-drawer">
      
<div class="toc-sticky toc-scroll">
   
    <div class="toc-title-container">
      <span class="toc-title">
       Contents
      </span>
    </div>
    <div class="toc-tree-container">
      <div class="toc-tree">
        <ul>
<li><a class="reference internal" href="#">Permissions</a><ul>
<li><a class="reference internal" href="#server">Server</a></li>
<li><a class="reference internal" href="#project">Project</a></li>
<li><a class="reference internal" href="#storage-pool">Storage pool</a></li>
<li><a class="reference internal" href="#identity">Identity</a></li>
<li><a class="reference internal" href="#group">Group</a></li>
<li><a class="reference internal" href="#identity-provider-group">Identity provider group</a></li>
<li><a class="reference internal" href="#certificate">Certificate</a></li>
<li><a class="reference internal" href="#instance">Instance</a></li>
<li><a class="reference internal" href="#image">Image</a></li>
<li><a class="reference internal" href="#image-alias">Image alias</a></li>
<li><a class="reference internal" href="#network">Network</a></li>
<li><a class="reference internal" href="#network-acl">Network ACL</a></li>
<li><a class="reference internal" href="#network-zone">Network zone</a></li>
<li><a class="reference internal" href="#profile">Profile</a></li>
<li><a class="reference internal" href="#storage-volume">Storage volume</a></li>
<li><a class="reference internal" href="#storage-bucket">Storage bucket</a></li>
</ul>
</li>
</ul>

      </div>
    </div>
   
    
  </div>

    </aside>
  </div>
</div><script src="../../_static/jquery.js?v=5d32c60e"></script>
    <script src="../../_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
    <script src="../../_static/documentation_options.js?v=187304be"></script>
    <script src="../../_static/doctools.js?v=9bcbadda"></script>
    <script src="../../_static/sphinx_highlight.js?v=dc90522c"></script>
    <script src="../../_static/scripts/furo.js?v=46bd48cc"></script>
    <script src="../../_static/clipboard.min.js?v=a7894cd8"></script>
    <script src="../../_static/copybutton.js?v=f281be69"></script>
    <script src="../../_static/config-options.js"></script>
    <script src="../../_static/design-tabs.js?v=f930bc37"></script>
    <script src="../../_static/header-nav.js?v=e117ad08"></script>
    <script src="../../_static/footer.js?v=5acea47a"></script>
    <script src="../../_static/github_issue_links.js?v=32bb732f"></script>
    <script src="../../_static/js/bundle.js?v=a4d88309"></script>
    
<script>
  const github_url = "https://github.com/canonical/lxd";
</script>
</body>
</html>