Tiyi v3.8.0

Permission catalog

Tiyi ships 59 permissions. Roles are sets of permissions; a JWT carries the union of its user's roles. tiyi:superadmin satisfies every check.

Read the live catalog from a running server with tiyi role permissions or RoleService.ListPermissions — this page is generated from the same seed data (permissionSeeds() in internal/store/bootstrap.go).

Permission	Grants	RPCs
`site:read`	Read sites and compiled config previews.	`LogService.GetSiteLogPolicy`, `OperationControlService.GetRequestInspection`, `OperationControlService.GetOperationControlState`, `OperationControlService.ListOperationControlHistory` +27 more
`site:write`	Create, update, enable, and disable sites.	`LogService.UpsertSiteLogPolicyOverride`, `LogService.DeleteSiteLogPolicyOverride`, `OperationControlService.PreviewBodyControl`, `OperationControlService.ApplyBodyControl` +23 more
`site:delete`	Delete sites.	`SiteService.DeleteSite`
`site:preview`	Preview compiled Caddy JSON.	`SiteService.PreviewCompiledConfig`
`upstream:read`	Read upstream pools.	`UpstreamService.ListUpstreams`, `UpstreamService.GetUpstream`, `UpstreamService.ListUpstreamHealth`, `SiteService.ExportSite` +1 more
`upstream:write`	Create and update upstream pools.	`UpstreamService.CreateUpstream`, `UpstreamService.UpdateUpstream`, `SiteService.ImportSite`
`upstream:delete`	Delete upstream pools.	`UpstreamService.DeleteUpstream`
`policy:read`	Read WAF policies, templates, versions, rules, lists, and plugins.	`PolicyService.ListPolicies`, `PolicyService.GetPolicy`, `PolicyService.ListPolicyTemplates`, `PolicyService.ListPolicyVersions` +35 more
`policy:write`	Create, update, rollback, and change policy engine state.	`PolicyService.CreatePolicy`, `PolicyService.CreatePolicyFromTemplate`, `PolicyService.UpdatePolicy`, `PolicyService.UpdatePolicyLayer` +9 more
`policy:delete`	Delete WAF policies.	`PolicyService.DeletePolicy`
`policy:preview`	Preview SecLang and CRS impact.	`PolicyService.PreviewSecLang`, `PolicyService.PreviewCrsImpact`, `CustomRuleService.PreviewCustomRule`
`policy:test`	Run synthetic policy tests.	`PolicyService.TestPolicy`
`policy:crs:write`	Switch active CRS rulesets.	`PolicyService.SetActiveCrsRuleset`
`policy:rule:override`	Manage per-CRS-rule overrides.	`RuleOverrideService.UpsertRuleOverride`, `RuleOverrideService.DeleteRuleOverride`, `RuleOverrideService.BulkUpsertRuleOverrides`
`policy:custom:write`	Manage custom visual rules.	`CustomRuleService.CreateCustomRule`, `CustomRuleService.UpdateCustomRule`, `CustomRuleService.DeleteCustomRule`, `CustomRuleService.ReorderCustomRules` +1 more
`policy:custom:seclang`	Author or import raw SecLang custom rules.	enforced in-handler or reserved
`policy:iplist:write`	Manage IP lists and entries.	`IpListService.CreateIpList`, `IpListService.UpdateIpList`, `IpListService.DeleteIpList`, `IpListService.ReplaceIpListEntries` +8 more
`policy:iplist:source:write`	Manage IP-list subscription sources and write-only request headers.	`IpListService.CreateIpListSubscription`, `IpListService.UpdateIpListSubscription`, `IpListService.TestIpListSource`
`policy:iplist:sync`	Test, synchronize, pause, and resume IP-list subscriptions.	`IpListService.SyncIpListNow`, `IpListService.PauseIpListSync`, `IpListService.ResumeIpListSync`, `IpListService.AcceptHeldIpListUpdate` +1 more
`policy:country:write`	Create, update, and delete country access rules.	`CountryAccessService.UpsertCountryAccessRule`, `CountryAccessService.DeleteCountryAccessRule`
`cert:read`	Read certificates and public certificate material.	`CertService.ListCerts`, `CertService.GetCert`, `CertService.ListDNSProviders`, `CertService.GetDNSProvider` +1 more
`cert:write`	Upload certificate PEM material.	`CertService.UploadCert`, `CertService.CreateDNSProvider`, `CertService.UpdateDNSProvider`, `SiteService.ImportSite`
`cert:issue`	Issue and renew ACME certificates.	`CertService.IssueACMECert`, `CertService.RenewCert`
`cert:export`	Export certificates with private keys.	`CertService.DownloadCert`, `SiteService.ExportSite`, `SiteService.ExportSites`
`cert:delete`	Delete certificates.	`CertService.DeleteCert`, `CertService.DeleteDNSProvider`
`agent:read`	Read nodes, events, metrics, and config bundles.	`AgentService.ListNodes`, `AgentService.ListAgents`, `AgentService.GetAgent`, `AgentService.GetNodeCapabilities` +5 more
`agent:write`	Update remote-agent metadata and retry node config.	`AgentService.UpdateAgent`, `AgentService.RetryNodeConfig`
`agent:delete`	Delete agents and revoke certificates.	`AgentService.DeleteAgent`
`agent:install`	Issue enrollment tokens and install scripts.	`AgentService.IssueEnrollmentToken`, `AgentService.CreateNodeInstallation`, `AgentService.GetNodeInstallStatus`
`agent_group:read`	Read agent groups.	`AgentGroupService.ListAgentGroups`, `AgentGroupService.GetAgentGroup`, `AgentGroupService.ResolveAgentGroup`
`agent_group:write`	Create and update agent groups.	`AgentGroupService.CreateAgentGroup`, `AgentGroupService.UpdateAgentGroup`
`agent_group:delete`	Delete agent groups.	`AgentGroupService.DeleteAgentGroup`
`log:read`	Query and tail logs.	`LogService.QuerySecurityEvents`, `LogService.QueryAccessEvents`, `LogService.QueryErrorEvents`, `LogService.GetSecurityEvent` +12 more
`log:export`	Export logs.	`LogService.ExportSecurityEvents`, `LogService.ExportAccessEvents`, `LogService.ExportErrorEvents`
`telemetry:read`	Read exact telemetry and API inventory counters.	`OperationControlService.GetRequestInspection`, `OperationControlService.GetOperationControlState`, `OperationControlService.ListOperationControlHistory`, `ApiSchemaService.GetSchemaValidation` +16 more
`api_inventory:write`	Confirm API assets and stage site-owned body or Schema candidates; staging also requires site:write.	`OperationControlService.PreviewBodyControl`, `OperationControlService.ApplyBodyControl`, `OperationControlService.PreviewBodyChange`, `OperationControlService.ChangeBodyControl` +13 more
`api_inventory:block`	Approve new blocking API controls; runtime changes also require inventory, site, and policy write permissions.	enforced in-handler or reserved
`alert:read`	Read and stream alerts.	`AlertService.ListAlerts`, `AlertService.GetAlert`, `AlertService.ListAlertRules`, `AlertService.GetAlertRule` +4 more
`alert:ack`	Acknowledge alerts.	`AlertService.AckAlert`
`alert:resolve`	Resolve alerts.	`AlertService.ResolveAlert`
`alert:write`	Manage alert rules and channels.	`AlertService.UpsertAlertRule`, `AlertService.ReplayAlertRule`, `AlertService.DeleteAlertRule`, `AlertService.UpsertAlertChannel` +7 more
`ai:read`	Use AI log analysis, chat, and read advisory proposals.	`AIService.ListAIProposals`, `AIService.GetAIProposal`, `AIService.GetAIStatus`, `AIService.TranslateLogQuery` +2 more
`ai:propose`	Generate AI advisory proposals (drafts; mutates nothing).	`AIService.DraftCustomRule`, `AIService.RejectAIProposal`
`ai:apply`	Apply an AI proposal through the audited mutation path (also requires the target permission).	`AIService.ApplyAIProposal`
`audit:read`	Query audit log and chain status.	`AuditService.QueryAudit`, `AuditService.GetAuditEntry`, `AuditService.GetChainStatus`
`audit:verify`	Trigger audit chain verification.	`AuditService.VerifyChain`
`user:read`	Read users.	`UserService.ListUsers`, `UserService.GetUser`
`user:write`	Create, update, and assign user roles.	`UserService.CreateUser`, `UserService.UpdateUser`, `UserService.AssignRoles`, `UserService.ResetPassword` +3 more
`user:delete`	Delete users.	`UserService.DeleteUser`
`role:read`	Read roles and permissions.	`RoleService.ListRoles`, `RoleService.GetRole`, `RoleService.ListPermissions`
`role:write`	Create and update roles.	`RoleService.CreateRole`, `RoleService.UpdateRole`
`role:delete`	Delete roles.	`RoleService.DeleteRole`
`system:read`	Read system settings, health, and dashboard statistics.	`LogService.GetGlobalLogPolicy`, `SystemService.Health`, `SystemService.GetSystemSettings`, `SystemService.GetObservationPipelineStats` +4 more
`system:write`	Update system settings.	`LogService.UpdateGlobalLogPolicy`, `AIService.SetAIProviderSecret`, `SystemService.UpdateSystemSettings`, `SystemService.ImportLicense` +5 more
`system:apply`	Preview and apply declarative manifests.	`SystemService.PreviewApply`, `SystemService.Apply`
`system:update:read`	Read releases, CRS rulesets, and upgrade runs.	`CrsService.ListUpstreamCrsExclusionPluginReleases`, `SystemService.ListBinaryReleases`, `SystemService.GetBinaryRelease`, `SystemService.ListSystemCrsRulesets` +7 more
`system:update:write`	Import and delete releases and CRS rulesets.	`CrsService.ImportCrsExclusionPlugin`, `SystemService.ImportBinaryRelease`, `SystemService.DeleteBinaryRelease`, `SystemService.ImportCrsRuleset` +4 more
`system:update:apply`	Apply, rollback, and cancel upgrades.	`SystemService.ApplyBinaryRelease`, `SystemService.RollbackBinaryRelease`, `SystemService.CancelUpgradeRun`
`tiyi:superadmin`	Reserved cross-tenant platform access.	enforced in-handler or reserved

Public procedures

These RPCs are reachable without a token. Everything else requires a bearer JWT (or the local admin socket).

RPC	Why it is public
`AgentService.Enroll`	gated by a one-use enrollment token, not a session
`AgentStreamService.Connect`	gated by the agent stream token
`EvidenceUploadService.Upload`	gated by the agent stream token
`AuthService.CompleteAuthenticationChallenge`	finishes a short-lived cookie-bound MFA/RADIUS challenge before any token exists
`AuthService.GetLoginOptions`	discovers enabled interactive sign-in methods
`AuthService.Login`	issues the first token
`AuthService.Logout`	must succeed even with a stale token
`AuthService.Refresh`	renews a token that has already expired

Permissions without a static RPC binding

A few permissions are checked inside handlers or on the REST telemetry surface in addition to the generated RPC contract:

Permission	Checked by
`telemetry:read`	every `/api/v1/telemetry/*` route (see HTTP endpoints)
`api_inventory:write`	`POST /api/v1/telemetry/apitree/action` — required for every action (`confirm`, `hide`, `restore`, `block`)
`api_inventory:block`	the `block` action on the same route, and `policy:write`, because it writes a custom rule
`log:read`	declared as an all-of requirement by `AIService.StreamAnalysis` and `AIService.StreamChat`
`policy:custom:seclang`	`CustomRuleService.CreateCustomRule` / `UpdateCustomRule` when the rule carries raw SecLang instead of a visual spec

policy:rule:override, policy:custom:write, and policy:iplist:write are the required granular mutation permissions for their respective resources.

Tiyi seeds three built-in roles: Administrator (all permissions), Auditor (read-only), and WAF Operator (daily WAF tuning without raw SecLang, alert-channel, identity, or platform administration). Create narrower roles with RoleService.CreateRole (tiyi role create) and assign them with UserService.AssignRoles.