Roles
What each role is allowed to do
Permissions are owned by the services
Each service holds its own permission set. How dashboard roles compose them is an open question, so this screen is read-only.
RewardsOperator
Full control of rewards: SKUs, voucher pools, campaigns, evaluation, grants.
12 permissionsOperators: 2
- Res.Campaigns
- Res.Campaigns.Create
- Res.Campaigns.Update
- Res.Campaigns.ChangeStatus
- Res.RewardSkus
- Res.RewardSkus.Manage
- Res.RewardSkus.UploadPins
- Res.Metrics
- Res.Evaluations
- Res.Evaluations.Run
- Res.Entitlements
- Res.Entitlements.Revoke
This role name is granted permissions by a backing service. Renaming it here would not change what the service grants.
CampaignOperator
Composes and runs campaigns, but cannot manage reward inventory.
8 permissionsOperators: 2
- Res.Campaigns
- Res.Campaigns.Create
- Res.Campaigns.Update
- Res.Campaigns.ChangeStatus
- Res.Metrics
- Res.Evaluations
- Res.Evaluations.Run
- Res.Entitlements
PlatformAdmin
Manages the mini app catalog, dashboard operators, and roles.
5 permissionsOperators: 2
- Gateway.MiniApps
- Gateway.MiniApps.Configure
- Dashboard.Operators
- Dashboard.Operators.Manage
- Dashboard.Roles
This role name is granted permissions by a backing service. Renaming it here would not change what the service grants.
SupportAgent
Looks up customers and manages their devices. Read-only on rewards.
4 permissionsOperators: 1
- Dashboard.Customers
- Dashboard.Customers.Devices.Manage
- Res.Entitlements
- Res.Campaigns
Auditor
Read-only across every section. Changes nothing.
7 permissionsOperators: 1
- Res.Campaigns
- Res.RewardSkus
- Res.Metrics
- Res.Evaluations
- Res.Entitlements
- Gateway.MiniApps
- Dashboard.Customers