_oss_roles_table.html.md.erb

<table id='oss-roles-permissions'>
<thead>
  <tr>
    <th>Activity</th>
    <th>Admin</th>
    <th>Admin Read-Only</th>
    <th>Global Auditor</th>
    <th>Org Manager</th>
    <th>Org Auditor</th>
    <th>Org Billing Manager</th>
    <th>Org User</th>
    <th>Space Manager</th>
    <th>Space Developer</th>
    <th>Space Auditor</th>
    <th>Space Supporter</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td>Scope of operation</td>
    <td>Org</td>
    <td>Org</td>
    <td>Org</td>
    <td>Org</td>
    <td>Org</td>
    <td>Org</td>
    <td>Org</td>
    <td>Space</td>
    <td>Space</td>
    <td>Space</td>
    <td>Space</td>
  </tr>
  <tr>
    <td>Assign user roles</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>View users and roles</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Create and assign org quota plans</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>View org quota plans</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Create orgs</td>
    <td>Yes</td>
    <td><sup><strong></strong></sup></td>
    <td><sup><strong></strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
    <td><sup><strong>1</strong></sup></td>
  </tr>
  <tr>
    <td>View all orgs</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>View orgs where user is member</td>
    <td>Yes<sup><strong>2</strong></sup></td>
    <td>Yes<sup><strong>2</strong></sup></td>
    <td>Yes<sup><strong>2</strong></sup></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Edit, rename, and delete orgs</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes<sup><strong>3</strong></sup></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Suspend or activate an org</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Create and assign space quota plans</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Create spaces</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>View spaces</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Edit spaces</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Delete spaces</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Rename spaces</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>View the status, number of instances, service bindings, and resource use of apps</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Add private domains<sup><strong>4</strong></sup></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Share private domains with other orgs</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes<sup><strong>5</strong></sup></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Deploy, run, and manage apps</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td>Limited<sup><strong>9</strong></sup></td>
  </tr>
  <tr>
    <td>View app logs</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Use app SSH<sup><strong>6</strong></sup></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Instantiate services</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Bind services to apps</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Manage global service brokers</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Manage space-scoped service brokers</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Associate routes<sup><strong>4</strong></sup>, modify resource allocation of apps</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Rename apps</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
   </tr>
   <tr>
    <td>Create and manage Application Security Groups</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Manage Application Security Groups for all spaces in an org</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Manage Application Security Groups for an individual space</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>Create, update, and delete an isolation segment</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>List all isolation segments for an org</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
  </tr>
  <tr>
    <td>Entitle or revoke an isolation segment</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>List all orgs entitled to an isolation segment</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
    <td>Yes<sup><strong>7</strong></sup></td>
  </tr>
  <tr>
    <td>Assign a default isolation segment to an org</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>List and manage isolation segments for spaces</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>List entitled isolation segments for a space</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>List the isolation segment on which an app runs</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>List app and service usage events</td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes</td>
    <td>Yes</td>
    <td>Yes</td>
  </tr>
  <tr>
    <td>Create, delete, and list container-to-container networking policies</td>
    <td>Yes</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td>Yes<sup><strong>8</strong></sup></td>
    <td></td>
    <td></td>
  </tr>
</tbody>  
</table>

<sup><strong>1</strong></sup>Not by default, unless feature flag `user_org_creation` is set to `true`.

<sup><strong>2</strong></sup>Admin, admin read-only, and global auditor roles do not need to be added as members of orgs or spaces to view resources.

<sup><strong>3</strong></sup>Org Managers can rename their orgs and edit some fields. They cannot delete orgs.

<sup><strong>4</strong></sup>Unless deactivated by feature flags.

<sup><strong>5</strong></sup>The user attempting to share must have permissions in both the source and target orgs.

<sup><strong>6</strong></sup>This assumes that SSH is enabled for the platform, space, and app. For more information, see [SSH Access Control Hierarchy](../devguide/deploy-apps/app-ssh-overview.html#ssh-access-control-hierarchy) in _App SSH Overview_.

<sup><strong>7</strong></sup>Applies only to orgs they belong to.

<sup><strong>8</strong></sup>Space Developers can optionally be granted these permissions. For more information, see [Grant Permissions](../devguide/deploy-apps/cf-networking.html#-grant-permissions) in _Configuring Container-to-Container Networking_.

<sup><strong>9</strong></sup>Cannot create packages or delete resources. For more information, see the [Cloud Controller V3 Documentation](https://v3-apidocs.cloudfoundry.org/).