Organize your IT landscape > Understanding Raynet One Permissions

Raynet One uses a flexible and fine-grained permission system based on resource groups and Access Control Lists (ACLs). These mechanisms enable controlled user access to various entity types through grouping them and assigning permissions at the group level.

Assets and ACLs

Entities like devices, networks, and databases are classified as assets. These assets do not belong to any specific user. By default, all users have full access to them.

When an ACL is applied to an asset via a resource group, only users with explicitly granted permissions in the ACL can view or operate on the asset. This mechanism provides precise control over asset visibility and permitted actions.

Operational Entities and Ownership

Operational entities - such as credentials, runners, scopes, and resource groups - are always created by a a specific user. This user becomes the owner of the entity.

•The owner automatically receives full control over the entity.

•Other users (except administrators) have no access unless granted explicitly through an ACL.

•Future versions may include owner-initiated direct sharing capabilities.

License Management Entities

License Management entities, such as purchases, follow a resource group and ACL-based permission model similar to assets.

•By default, purchases are accessible to users with the License Manager role.

•When a purchase is assigned to a resource group with ACLs, access is restricted according to the granted permissions.

•Related License Management entities inherit their permissions from the associated purchases.

•Administrators always retain full access.

For agreements, commercial products, technical products, entitlements, and compliance, inherited permissions are calculated based on all directly or indirectly linked purchases:

•View: Requires View permission on at least one linked purchase.

•Edit: Requires Edit permission on at least one linked purchase.

•Delete: Requires Delete permission on all linked purchases.

If an entity has no directly or indirectly linked purchases, it is accessible to all users with the License Manager role. For entitlements, the displayed quantity includes only quantities from linked purchases that the user has permission to view.

Some dependent entities, such as calendar events, document files, document members, and license demands, do not have separate permission records. Access to these entities is checked through their related parent entities. For example, a calendar event linked to a purchase can only be accessed if the user has the required permission on that purchase.

Access Control Lists (ACLs)

ACLs define the permissions (View, Edit, Delete) for all entities within a resource group. They are assigned to user groups, and each user inherits the ACLs assigned to the groups they belong to.

Permission Context

Introduced in Raynet One 1.2, the Permission Context is a computed model that defines the exact permissions a user has over all available entities in the system. It is determined exclusively by the ACLs assigned to the user's groups. The Permission Context does not consider roles. It purely reflects access based on ACLs.

Roles and Effective Permissions

While the Permission Context defines what entities a user can see and what entity-level actions (like View, Edit, or Delete) are permitted based on ACLs, a user's role governs what kinds of operations or features are available to them in the application. Importantly, many operations in Raynet One require both:

•Sufficient permissions in the user's Permission Context (e.g., Edit permission on a device).

•The correct role (e.g., Asset Manager) that allows the user to perform such operations on that type of entity.

For example:

•A user with the Edit permission on a device might still be unable to perform operational tasks (e.g., gathering inventory data), unless their role explicitly allows it.

•Another user with a more limited role might be able to edit corporate metadata of a device, but cannot initiate device inventory or access sensitive device data (open ports).

This dual-layer model enables fine-grained access control: ACLs determine where a user has access, and roles determine permitted actions within that scope.

Summary

•Assets: Public by default, access restricted via ACLs.

•Operational Entities: Private to their creators unless shared through ACLs.

•License Management Entities: Accessible to License Managers by default; access is restricted through purchase ACLs and inherited by related entities.

•Owners: Always have full access to their created entities.

•ACLs: Define permissions (View, Edit, Delete) on grouped resources, assigned via user groups.

•Permission Context: Based on ACLs; defines a user's access to specific entities.

•Roles: Define which operations a user can perform when they have access to an entity.

•Effective Permissions = Permission Context (what entities and actions are visible/allowed) x User Role (what operations are available)

•Certain operations require both a matching ACL permission and an appropriate role.

Permission Matrix

A permission matrix defines the required combination of role and ACL-derived permission to perform operations on different entity types. It acts as a guideline for evaluating user capabilities across the system.

Legend

View required on Entity [ACL]

Edit required on Entity [ACL]

Delete required on Entity [ACL]

Workspace	Type	Module	Permission	Guest	User	Asset Manager	Global Asset Manager	License Manager	Admin	ACL Details
Asset Management	View	IT Visibility	View		✓	✓	✓	✓	✓	Based on overall View permissions
Asset Management	View	Devices	View All devices		✓	✓	✓	✓	✓	[Device View required]
Asset Management	View	Scheduled Job	View Automation			✓	✓		✓	[Scheduled Job View required]
Asset Management	Action	Scheduled Job	Remove Scheduled Tasks			✓	✓		✓
Asset Management	Action	Scheduled Job	Edit Scheduled Tasks			✓	✓		✓
Asset Management	Action	Scheduled Job	Run Scheduled Tasks			✓	✓		✓
Asset Management	Action	Scheduled Job	Create Scheduled Tasks			✓	✓		✓
Asset Management	View	Devices	View Troubleshooting			✓	✓		✓	[Device View required]
Asset Management	View	Devices	View Advanced Device Details			✓	✓		✓	[Device View required]
Asset Management	Action	Devices	Configure Connector				✓		✓
Asset Management	Action	Devices	Manually Add Device			✓	✓		✓	[Scope Edit required] (see note 1)
Asset Management	Action	Devices	Remove Device			✓	✓		✓	[Device Delete required]
Asset Management	Action	Devices	Trigger Device Inventory			✓	✓		✓	[Device Edit required]
Asset Management	Action	Devices	Change Corporate Information		✓	✓	✓	✓	✓	[Device Edit required]
Asset Management	View	Networks	View Networks			✓	✓		✓	[Network View required]
Asset Management	Action	Networks	Trigger Network Discovery			✓	✓		✓	[Network Edit required]
Asset Management	Action	Networks	Remove Network			✓	✓		✓	[Network Delete required]
Asset Management	Action	Networks	Manually Add Network			✓	✓		✓	[Scope Edit required] (see note 2)
Asset Management	View	Software	View Software Library (Software, Vendors, Vulnerabilities etc.)		✓	✓	✓	✓	✓	[Device View required]
Asset Management	View	Hardware	View Hardware Library (CPU, GPU, Models)		✓	✓	✓	✓	✓	[Device View required]
Asset Management	View	Databases	View Oracle Databases		✓	✓	✓	✓	✓	[Oracle/Device View required]
Asset Management	View	Databases	View Advanced Oracle Database Details			✓	✓		✓	[Oracle/Device View required]
Asset Management	Action	Databases	Remove Database			✓	✓		✓	[Oracle/Device Delete required]
Asset Management	Action	Databases	Discover Database			✓	✓		✓	[Device Edit required] (see note 3)
Asset Management	Action	Databases	Inventory Database			✓	✓		✓	[Oracle/Device Edit required]
Asset Management	View	Containers	View Docker Services		✓	✓	✓	✓	✓	[Device View required]
Asset Management	View	Hypervisors	View Hypervisor Services		✓	✓	✓	✓	✓	[Device View required]

License Management	View	Purchases	View Purchases					✓	✓	[Purchase View required]
License Management	Action	Purchases	Edit Purchase					✓	✓	[Purchase Edit required]
License Management	Action	Purchases	Remove Purchase					✓	✓	[Purchase Delete required]
License Management	View	Purchase Items	View Purchase Items					✓	✓	[Purchase View required]
License Management	Action	Purchase Items	Edit Purchase Item					✓	✓	[Purchase Edit required]
License Management	Action	Purchase Items	Remove Purchase Item					✓	✓	[Purchase Delete required]
License Management	View	Agreements	View Agreements					✓	✓	[View on ≥1 linked Purchase required]
License Management	Action	Agreements	Edit Agreement					✓	✓	[Edit on ≥1 linked Purchase required]
License Management	Action	Agreements	Remove Agreement					✓	✓	[Delete on all linked Purchases required]
License Management	View	Commercial Products	View Commercial Products					✓	✓	[View on ≥1 linked Purchase required]
License Management	Action	Commercial Products	Edit Commercial Product					✓	✓	[Edit on ≥1 linked Purchase required]
License Management	Action	Commercial Products	Remove Commercial Product					✓	✓	[Delete on all linked Purchases required]
License Management	View	Technical Products	View Technical Products					✓	✓	[View on ≥1 linked Purchase required]
License Management	Action	Technical Products	Edit Technical Product					✓	✓	[Edit on ≥1 linked Purchase required]
License Management	Action	Technical Products	Remove Technical Product					✓	✓	[Delete on all linked Purchases required]
License Management	View	Entitlements	View Entitlements					✓	✓	[View on ≥1 linked Purchase required]
License Management	Action	Entitlements	Edit Entitlement					✓	✓	[Edit on ≥1 linked Purchase required]
License Management	Action	Entitlements	Remove Entitlement					✓	✓	[Delete on all linked Purchases required]
License Management	Action	Entitlements	Allocate licenses to Resource Group					✓	✓	[Required Resource Group ACL permission]
License Management	Action	Entitlements	Assign Responsibility to User Group					✓	✓	[User must belong to the User Group]
License Management	View	Compliance	View Compliance					✓	✓	[View on ≥1 linked Purchase required]
License Management	Action	Compliance	Add Compliance					✓	✓	[Edit on the selected Entitlement required]
License Management	Action	Compliance	Edit Compliance					✓	✓	[Edit on ≥1 linked Purchase required]
License Management	Action	Compliance	Remove Compliance					✓	✓	[Delete on all linked Purchases required]

Configuration	View	Runners	View runners			✓	✓		✓	[Runner View required]
Configuration	View	Runners	View runner download page			✓	✓		✓
Configuration	View	Runners	View Advanced runner configuration			✓	✓		✓	[Runner Edit required]
Configuration	Action	Runners	Add runner			✓	✓		✓
Configuration	Action	Runners	Remove runner			✓	✓		✓	[Runner Delete required]
Configuration	Action	Runners	Configure runner configuration			✓	✓		✓	[Runner Edit required]
Configuration	View	Runners	View runner scopes			✓	✓		✓	[Scope View & Runner Edit required]
Configuration	Action	Runners	Configure runner scopes			✓	✓		✓	[Scope Edit & Runner Edit required]
Configuration	View	Runners	View runner services			✓	✓		✓	[Runner Edit required]
Configuration	Action	Runners	Configure runner services			✓	✓		✓	[Runner Edit required]
Configuration	View	Scopes	View Scopes			✓	✓		✓	[Scope View required]
Configuration	Action	Scopes	Remove Scope				✓		✓
Configuration	View	Scopes	Add new scope				✓		✓
Configuration	View	Credentials	View credentials			✓	✓		✓	[Credentials View required]
Configuration	Action	Credentials	Add credentials			✓	✓		✓
Configuration	View	Credentials	View credential details			✓	✓		✓	[Credentials View required]
Configuration	Action	Credentials	Remove credentials			✓	✓		✓	[Credentials Delete required]
Configuration	Action	Credentials	Edit credential details			✓	✓		✓	[Credentials Edit required]
Configuration	Action	Credentials	Assign credential to resource group			✓	✓		✓	[Credentials Edit & Resource group Edit required] (see note 4)
Configuration	Action	Credentials	Assign credentials to devices/networks			✓	✓		✓	[Device/Network View & Credentials Edit required]
Configuration	View	Users	View Users				✓		✓
Configuration	View	Users groups	View Users Groups				✓		✓
Configuration	Action	Resource groups	Remove Resource group			✓	✓		✓	[Resource group Delete required]
Configuration	View	Resource groups	View Resource groups			✓	✓		✓	[Resource group View required]
Configuration	Action	Resource groups	Create Resource group			✓	✓		✓
Configuration	Action	Resource groups	Assign Entities to Resource group			✓	✓		✓	[Resource group Edit required] [Entity Edit required]
Configuration	Action	Resource groups	Unassign Entities from Resource group (Overwrite dynamic assignm.)			✓	✓		✓	[Resource group Edit required] [Entity Edit required]
Configuration	View	Resource groups	View & Configure dynamic group assignments				✓		✓
Configuration	Action	Resource groups	Configure dynamic group assignments				✓		✓
Configuration	View	Resource groups	View ACLs				✓		✓
Configuration	Action	Resource groups	Configure ACLs				✓		✓
Configuration	View	Integrations	View Integrations						✓
Configuration	Action	Integrations	Configure Integrations						✓
Configuration	View	Plugins	View Installed Plugins				✓		✓
Configuration	Action	Plugins	Enable/Disable Plugins				✓		✓
Configuration	Action	Plugins	Configure instruments				✓		✓
Configuration	Action	Settings	Default Run Book			✓	✓		✓
Configuration	Action	Settings	Default Port Settings			✓	✓		✓
Configuration	Action	Settings	Inventory Settings			✓	✓		✓
Configuration	Action	Settings	Import Settings				✓		✓
Configuration	Action	Settings	Oracle Settings			✓	✓		✓
Configuration	Action	Settings	License Management settings				✓	✓	✓
Configuration	View	Inventory Scripts	View Scripts			✓	✓		✓	[InvScript View required]
Configuration	Action	Inventory Scripts	Remove Script			✓	✓		✓	[InvScript Delete required]
Configuration	Action	Inventory Scripts	Add Script			✓	✓		✓
Configuration	Action	Inventory Scripts	Edit Script			✓	✓		✓	[InvScript Edit required]
Configuration	View	About	About						✓

Shared	View	Action Center	View Action Center			✓	✓	✓	✓	(see note 5)
Shared	Action	Action Center	Answer Notifications			✓	✓	✓	✓	[Job Edit required]
Shared	View	Jobs	View Job List			✓	✓	✓	✓	[Job View required] (see note 5)

Notes

1.To create a device, the user needs Edit permission on the scope in which the device is created.

2.To create a network, the user needs Edit permission on the scope in which the network is created.

3.To discover Oracle databases on devices, the user needs Edit permission on the respective devices.

4.To assign credentials to a resource group, the user needs Edit permission on both the resource group and the credentials.

5.Jobs are owned by the user who started them. Other users see them only when the jobs are shared through an ACL.