Permissions

Actions

Action	Allows
blueprints/read	See the catalog and each blueprint, start a deploy, follow and retry deploys, and list the boundary's catalog sources
blueprints/templates/write	Save, replace and delete templates through the API; add, change, sync and remove catalog sources; Refresh catalog

What a deploy checks

A deploy creates everything with your own permissions, so it needs the actions for what it creates. The preflight checks ask for them before anything is created.

Action	Where	Needed when
blueprints/read	The boundary	Always
secretvault/write	The resource group	The blueprint needs a vault
secretvault/writeSecrets	The instance vault	The blueprint writes values into its vault. A data action
postgrescluster/write	The resource group	For each PostgreSQL resource the blueprint declares
postgrescluster/readSecrets	The database	Its connection details are written into the vault. A data action, and not among the preflight checks
kernel/deployments/read	The boundary	A container pulls its image through a private registry
containerinstance/write	The resource group	Always
rbac/members/write	The instance vault	The blueprint needs a vault: its identity is given Secrets Reader on it. The grant itself also needs Owner or Platform Owner on the vault or above, assigned to you directly or activated through just-in-time access; Owner held through a group does not count, and the preflight checks do not see the difference

Retrying a failed deploy runs under the permissions of whoever retries it, and blueprints/read on the boundary is enough to see and retry every deploy in the boundary, whoever started it — see Retry a failed deploy. Deleting a deployed instance also deletes its vault, so it needs secretvault/delete on the vault as well as containerinstance/delete.

Roles

Role	Catalog	Templates and catalog sources	Deploy
Reader, Blueprint Reader	See	No	No
Blueprints Operator	See	Manage	Only blueprints that need no vault: it cannot write secret values, provision databases or grant vault access
Contributor	See	Manage	Everything except the vault grant, which needs an Owner of the vault — request it with Just-in-time access
Owner	See	Manage	Everything, when the role is assigned to you directly. Owner held through a group needs temporary access for the vault grant

Assign roles on the boundary, a resource group or a single resource — see Built-in roles. The catalog and the deploy check blueprints/read on the boundary, so a role assigned only on a resource group neither shows the catalog nor lets you deploy into that group.