Permissions Reference

Overview

ASCEND implements 23+ granular permissions organized into 8 categories. Permissions are assigned to roles at specific access levels, creating a hierarchical permission model where higher levels inherit permissions from lower levels.

Why It Matters

Granular permissions enable:

Precise Access Control: Grant exactly the access needed for each function
Audit Compliance: Track specific actions, not just general access
Custom Roles: Build custom permission sets for specific use cases
Separation of Duties: Enforce different permissions for different operations

Permission Categories

Category Overview

Category	Permission Count	Description
Dashboard	2	Dashboard viewing and export
Analytics	3	Analytics features and reports
Alerts	4	Alert management and triage
Rules	4	Smart rule configuration
Authorization	6	Action approval workflow
Users	6	User management
Audit	3	Audit log access
System	3	System administration
Total	31

Dashboard Permissions

dashboard.view

Permission String: dashboard.view

Property	Value
Category	Dashboard
Minimum Level	BASIC (1)
Description	View the main dashboard
Risk	Low

Grants Access To:

View dashboard widgets
View agent status summaries
View alert counts
View policy status

API Endpoints:

GET /v1/dashboard
GET /v1/dashboard/summary
GET /v1/dashboard/widgets

dashboard.export

Permission String: dashboard.export

Property	Value
Category	Dashboard
Minimum Level	POWER (2)
Description	Export dashboard data
Risk	Low

Grants Access To:

Export dashboard as PDF
Export dashboard data as CSV
Schedule dashboard reports

API Endpoints:

GET /v1/dashboard/export
POST /v1/dashboard/export/pdf
POST /v1/dashboard/export/csv

Analytics Permissions

analytics.view

Permission String: analytics.view

Property	Value
Category	Analytics
Minimum Level	POWER (2)
Description	View analytics data
Risk	Low

Grants Access To:

View analytics charts
View trend data
View agent performance metrics

API Endpoints:

GET /v1/analytics
GET /v1/analytics/trends
GET /v1/analytics/agents

analytics.reports

Permission String: analytics.reports

Property	Value
Category	Analytics
Minimum Level	MANAGER (3)
Description	Generate analytics reports
Risk	Medium

Grants Access To:

Generate compliance reports
Generate risk assessment reports
Access executive dashboard
Schedule recurring reports

API Endpoints:

GET /v1/analytics/reports
POST /v1/analytics/reports/generate
POST /v1/analytics/reports/schedule
GET /v1/executive/dashboard

analytics.export

Permission String: analytics.export

Property	Value
Category	Analytics
Minimum Level	MANAGER (3)
Description	Export analytics data
Risk	Medium

Grants Access To:

Export raw analytics data
Export reports as PDF/CSV
Access data for external tools

API Endpoints:

GET /v1/analytics/export
POST /v1/analytics/export/csv
POST /v1/analytics/export/json

Alert Permissions

alerts.view

Permission String: alerts.view

Property	Value
Category	Alerts
Minimum Level	POWER (2)
Description	View security alerts
Risk	Low

Grants Access To:

View alert list
View alert details
View alert history
Filter and search alerts

API Endpoints:

GET /v1/alerts
GET /v1/alerts/{id}
GET /v1/alerts/history

alerts.acknowledge

Permission String: alerts.acknowledge

Property	Value
Category	Alerts
Minimum Level	POWER (2)
Description	Acknowledge alerts
Risk	Low

Grants Access To:

Mark alerts as acknowledged
Add acknowledgment notes
Assign alerts to users

API Endpoints:

POST /v1/alerts/{id}/acknowledge
PUT /v1/alerts/{id}/assign

alerts.correlate

Permission String: alerts.correlate

Property	Value
Category	Alerts
Minimum Level	MANAGER (3)
Description	Correlate related alerts
Risk	Medium

Grants Access To:

Link related alerts
Create alert groups
View correlation analysis
Run correlation rules

API Endpoints:

POST /v1/alerts/correlate
POST /v1/alerts/groups
GET /v1/alerts/correlation

alerts.dismiss

Permission String: alerts.dismiss

Property	Value
Category	Alerts
Minimum Level	ADMIN (4)
Description	Dismiss/close alerts
Risk	High

Grants Access To:

Dismiss alerts (mark as false positive)
Close alerts
Bulk dismiss alerts

API Endpoints:

POST /v1/alerts/{id}/dismiss
POST /v1/alerts/bulk-dismiss
DELETE /v1/alerts/{id}

Rules Permissions

rules.view

Permission String: rules.view

Property	Value
Category	Rules
Minimum Level	ADMIN (4)
Description	View smart rules
Risk	Low

Grants Access To:

View rule configurations
View rule status
View rule history

API Endpoints:

GET /v1/rules
GET /v1/rules/{id}
GET /v1/rules/{id}/history

rules.create

Permission String: rules.create

Property	Value
Category	Rules
Minimum Level	ADMIN (4)
Description	Create new rules
Risk	High

Grants Access To:

Create new smart rules
Clone existing rules
Import rule templates

API Endpoints:

POST /v1/rules
POST /v1/rules/clone/{id}
POST /v1/rules/import

rules.modify

Permission String: rules.modify

Property	Value
Category	Rules
Minimum Level	ADMIN (4)
Description	Modify existing rules
Risk	High

Grants Access To:

Edit rule conditions
Enable/disable rules
Update rule priorities

API Endpoints:

PUT /v1/rules/{id}
PATCH /v1/rules/{id}/status
PUT /v1/rules/{id}/priority

rules.delete

Permission String: rules.delete

Property	Value
Category	Rules
Minimum Level	ADMIN (4)
Description	Delete rules
Risk	High

Grants Access To:

Delete rules
Archive rules
Bulk delete rules

API Endpoints:

DELETE /v1/rules/{id}
POST /v1/rules/{id}/archive
DELETE /v1/rules/bulk

Authorization Permissions

auth.view_pending

Permission String: auth.view_pending

Property	Value
Category	Authorization
Minimum Level	MANAGER (3)
Description	View pending approvals
Risk	Low

Grants Access To:

View pending action queue
View approval history
View action details

API Endpoints:

GET /v1/authorizations/pending
GET /v1/authorizations/history
GET /v1/actions/{id}

auth.approve_low

Permission String: auth.approve_low

Property	Value
Category	Authorization
Minimum Level	MANAGER (3)
Description	Approve low-risk actions (0-49)
Risk	Medium

Grants Access To:

Approve actions with risk score 0-49
Add approval notes
Request additional review

API Endpoints:

POST /v1/actions/{id}/approve  # risk_score < 50
POST /v1/actions/{id}/request-review

auth.approve_medium

Permission String: auth.approve_medium

Property	Value
Category	Authorization
Minimum Level	MANAGER (3)
Description	Approve medium-risk actions (50-69)
Risk	Medium

Grants Access To:

Approve actions with risk score 50-69
Escalate to higher level
Request additional information

API Endpoints:

POST /v1/actions/{id}/approve  # 50 <= risk_score < 70
POST /v1/actions/{id}/escalate

auth.approve_high

Permission String: auth.approve_high

Property	Value
Category	Authorization
Minimum Level	ADMIN (4)
Description	Approve high-risk actions (70-89)
Risk	High

Grants Access To:

Approve actions with risk score 70-89
Provide first approval for SoD
Request executive review

API Endpoints:

POST /v1/actions/{id}/approve  # 70 <= risk_score < 90

Note: High-risk actions require dual approval (Separation of Duties).

auth.approve_critical

Permission String: auth.approve_critical

Property	Value
Category	Authorization
Minimum Level	EXECUTIVE (5)
Description	Approve critical-risk actions (90-100)
Risk	Critical

Grants Access To:

Approve actions with risk score 90-100
Provide second approval for critical SoD
Override blocked actions (with justification)

API Endpoints:

POST /v1/actions/{id}/approve  # risk_score >= 90

Note: Critical actions require dual EXECUTIVE approval from different departments.

auth.emergency_override

Permission String: auth.emergency_override

Property	Value
Category	Authorization
Minimum Level	EXECUTIVE (5)
Description	Emergency override capability
Risk	Critical

Grants Access To:

Override blocked actions in emergencies
Bypass normal approval workflow
Immediate action execution

API Endpoints:

POST /v1/actions/{id}/emergency-override

Requirements:

Dual EXECUTIVE approval required
Written justification mandatory
Immediate audit notification
24-hour review requirement

User Permissions

users.view

Permission String: users.view

Property	Value
Category	Users
Minimum Level	ADMIN (4)
Description	View user information
Risk	Low

Grants Access To:

View user list
View user details
View user activity

API Endpoints:

GET /v1/users
GET /v1/users/{id}
GET /v1/users/{id}/activity

users.create

Permission String: users.create

Property	Value
Category	Users
Minimum Level	ADMIN (4)
Description	Create new users
Risk	High

Grants Access To:

Create new user accounts
Send invitations
Bulk import users

API Endpoints:

POST /v1/users
POST /v1/users/invite
POST /v1/users/import

users.modify

Permission String: users.modify

Property	Value
Category	Users
Minimum Level	ADMIN (4)
Description	Modify user information
Risk	High

Grants Access To:

Update user profile
Change user status
Update user settings

API Endpoints:

PUT /v1/users/{id}
PATCH /v1/users/{id}/status
PUT /v1/users/{id}/settings

users.delete

Permission String: users.delete

Property	Value
Category	Users
Minimum Level	EXECUTIVE (5)
Description	Delete users
Risk	Critical

Grants Access To:

Delete user accounts
Deactivate users permanently
Remove user data

API Endpoints:

DELETE /v1/users/{id}
POST /v1/users/{id}/deactivate

users.reset_password

Permission String: users.reset_password

Property	Value
Category	Users
Minimum Level	ADMIN (4)
Description	Reset user passwords
Risk	High

Grants Access To:

Trigger password reset
Force password change
Unlock locked accounts

API Endpoints:

POST /v1/users/{id}/reset-password
POST /v1/users/{id}/force-password-change
POST /v1/users/{id}/unlock

users.manage_roles

Permission String: users.manage_roles

Property	Value
Category	Users
Minimum Level	EXECUTIVE (5)
Description	Manage user roles
Risk	Critical

Grants Access To:

Change user roles
Assign custom permissions
Manage role templates

API Endpoints:

PUT /v1/users/{id}/role
POST /v1/users/{id}/permissions
GET /v1/roles

Note: Role changes require Separation of Duties (MANAGER + ADMIN approval).

Audit Permissions

audit.view

Permission String: audit.view

Property	Value
Category	Audit
Minimum Level	MANAGER (3)
Description	View audit logs
Risk	Medium

Grants Access To:

View audit log entries
Search audit history
View compliance reports

API Endpoints:

GET /v1/audit
GET /v1/audit/search
GET /v1/audit/compliance

audit.export

Permission String: audit.export

Property	Value
Category	Audit
Minimum Level	ADMIN (4)
Description	Export audit logs
Risk	High

Grants Access To:

Export audit logs as CSV/JSON
Generate audit reports
Download compliance evidence

API Endpoints:

GET /v1/audit/export
POST /v1/audit/export/csv
POST /v1/audit/export/report

audit.delete

Permission String: audit.delete

Property	Value
Category	Audit
Minimum Level	EXECUTIVE (5)
Description	Delete audit logs
Risk	Critical

Grants Access To:

Delete audit entries (with justification)
Archive old logs
Manage retention policies

API Endpoints:

DELETE /v1/audit/{id}  # Requires justification
POST /v1/audit/archive
PUT /v1/audit/retention

Warning: Audit log deletion is heavily restricted and logged. Most compliance frameworks prohibit deletion during retention period.

System Permissions

system.config

Permission String: system.config

Property	Value
Category	System
Minimum Level	ADMIN (4)
Description	System configuration
Risk	High

Grants Access To:

Modify system settings
Configure integrations
Manage organization settings

API Endpoints:

GET /v1/settings
PUT /v1/settings
GET /v1/integrations
PUT /v1/integrations/{id}

system.backup

Permission String: system.backup

Property	Value
Category	System
Minimum Level	EXECUTIVE (5)
Description	System backup operations
Risk	Critical

Grants Access To:

Trigger manual backups
Configure backup schedules
Restore from backup

API Endpoints:

POST /v1/system/backup
GET /v1/system/backups
POST /v1/system/restore

system.maintenance

Permission String: system.maintenance

Property	Value
Category	System
Minimum Level	EXECUTIVE (5)
Description	System maintenance
Risk	Critical

Grants Access To:

Enable maintenance mode
Run system diagnostics
Perform database maintenance

API Endpoints:

POST /v1/system/maintenance/enable
POST /v1/system/maintenance/disable
POST /v1/system/diagnostics

Permission Matrix by Role

Permission	RESTRICTED	BASIC	POWER	MANAGER	ADMIN	EXECUTIVE
dashboard.view	-	X	X	X	X	X
dashboard.export	-	-	X	X	X	X
analytics.view	-	-	X	X	X	X
analytics.reports	-	-	-	X	X	X
analytics.export	-	-	-	X	X	X
alerts.view	-	-	X	X	X	X
alerts.acknowledge	-	-	X	X	X	X
alerts.correlate	-	-	-	X	X	X
alerts.dismiss	-	-	-	-	X	X
rules.view	-	-	-	-	X	X
rules.create	-	-	-	-	X	X
rules.modify	-	-	-	-	X	X
rules.delete	-	-	-	-	X	X
auth.view_pending	-	-	-	X	X	X
auth.approve_low	-	-	-	X	X	X
auth.approve_medium	-	-	-	X	X	X
auth.approve_high	-	-	-	-	X	X
auth.approve_critical	-	-	-	-	-	X
auth.emergency_override	-	-	-	-	-	X
users.view	-	-	-	-	X	X
users.create	-	-	-	-	X	X
users.modify	-	-	-	-	X	X
users.delete	-	-	-	-	-	X
users.reset_password	-	-	-	-	X	X
users.manage_roles	-	-	-	-	-	X
audit.view	-	-	-	X	X	X
audit.export	-	-	-	-	X	X
audit.delete	-	-	-	-	-	X
system.config	-	-	-	-	X	X
system.backup	-	-	-	-	-	X
system.maintenance	-	-	-	-	-	X

Compliance Mapping

Framework	Control	Related Permissions
SOC 2	CC6.1	All permission categories
HIPAA	164.312(a)(1)	users.*, audit.view
PCI-DSS	Req 7.1	All authorization permissions
PCI-DSS	Req 10.1	audit.*
NIST 800-53	AC-3	All permissions
NIST 800-53	AU-9	audit.delete (restricted)

Next Steps

AI Security Overview - AI-specific security controls
Prompt Security - Prompt injection detection
Code Analysis - Code pattern detection

Overview​

Why It Matters​

Permission Categories​

Category Overview​

Dashboard Permissions​

dashboard.view​

dashboard.export​

Analytics Permissions​

analytics.view​

analytics.reports​

analytics.export​

Alert Permissions​

alerts.view​

alerts.acknowledge​

alerts.correlate​

alerts.dismiss​

Rules Permissions​

rules.view​

rules.create​

rules.modify​

rules.delete​

Authorization Permissions​

auth.view_pending​

auth.approve_low​

auth.approve_medium​

auth.approve_high​

auth.approve_critical​

auth.emergency_override​

User Permissions​

users.view​

users.create​

users.modify​

users.delete​

users.reset_password​

users.manage_roles​

Audit Permissions​

audit.view​

audit.export​

audit.delete​

System Permissions​

system.config​

system.backup​

system.maintenance​

Permission Matrix by Role​

Compliance Mapping​

Next Steps​

Overview

Why It Matters

Permission Categories

Category Overview

Dashboard Permissions

dashboard.view

dashboard.export

Analytics Permissions

analytics.view

analytics.reports

analytics.export

Alert Permissions

alerts.view

alerts.acknowledge

alerts.correlate

alerts.dismiss

Rules Permissions

rules.view

rules.create

rules.modify

rules.delete

Authorization Permissions

auth.view_pending

auth.approve_low

auth.approve_medium

auth.approve_high

auth.approve_critical

auth.emergency_override

User Permissions

users.view

users.create

users.modify

users.delete

users.reset_password

users.manage_roles

Audit Permissions

audit.view

audit.export

audit.delete

System Permissions

system.config

system.backup

system.maintenance

Permission Matrix by Role

Compliance Mapping

Next Steps