IAM roles & permissions

Isoward IAM is workspace-scoped (no per-service bindings yet). Built-in roles map to fixed permission sets. Admins can create custom roles with any subset of the permission catalog and assign them to members, invites, and API keys.

Manage in the dashboard

Open Team → Roles & permissions to list built-in and custom roles, create roles with grouped permission checkboxes, and delete unused custom roles. Member and API key selectors include custom roles automatically.

Permission catalog

Permissions are checked on mutating API routes. Grants are workspace-wide.

Services

Permission	What it grants
`services.read`	List and view services
`services.write`	Create and update services
`services.delete`	Delete or suspend services

Deploys

Permission	What it grants
`deploys.read`	View deploy history and status
`deploys.write`	Trigger deploys and rollbacks

Environment & secrets

Permission	What it grants
`env.read`	Read environment variable metadata
`env.write`	Create and update environment variables
`secrets.read`	Reveal secret values

Domains & data

Permission	What it grants
`domains.write`	Manage custom domains
`datastores.write`	Create and manage Postgres / Key Value

Team & IAM

Permission	What it grants
`team.read`	View members, invites, and roles
`team.manage`	Invite, remove, and change member roles
`iam.roles.manage`	Create, edit, and delete custom roles
`apikeys.manage`	Create and revoke API keys

Workspace

Permission	What it grants
`workspace.manage`	Workspace settings and maintenance
`billing.manage`	Billing and plan changes
`audit.read`	Read audit logs
`github.manage`	Connect and manage GitHub installs

Built-in roles

Role	Permissions
`viewer`	`services.readdeploys.readenv.readteam.read`
`developer`	Viewer set plus write access for services, deploys, env, secrets, domains, datastores, and GitHub (11 permissions).
`admin`	All permissions in the catalog (full workspace control).

API

List the caller's effective permissions:

http

GET /v1/permissions
Authorization: Bearer $ISOWARD_API_TOKEN

List or fetch roles (team.read):

http

GET /v1/roles
GET /v1/roles/:id
Authorization: Bearer $ISOWARD_API_TOKEN

Create, update, or delete a custom role (iam.roles.manage):

http

POST /v1/roles
Authorization: Bearer $ISOWARD_API_TOKEN
Content-Type: application/json

{
  "name": "deployer",
  "description": "Deploy without team admin",
  "permissions": ["services.read", "deploys.read", "deploys.write"]
}

PATCH /v1/roles/:id
DELETE /v1/roles/:id