Permissions

All operations in rWeb, either via the GUI or the API, require appropriate permissions. Permissions are broken into several categories. In these categories, your permission level can be one of Read write (both view and edit), Read only (view only), or None (no permissions). Where users have no permissions, they won't be able to see relevant data for that permission. For example, a user with no Device permissions will not see a list of devices or device traffic overview when they go to the Dashboard.

info

Users under the Default Group with the "rWeb Admin" set of default permissions are considered system adminstrators with full access to the system. This particular role is hard coded and cannot be removed or modified to prevent irreversible operations to the system.

Permission	Read / Write	Read Only	None
Group Admin	The user can update their existing group and create new subgroups, as well as configure resource limits.	N/A	The user can navigate their existing groups.
User Admin	The user can create, update, and delete new users and roles for their group and subgroups. In order to have this permission, the role must also have Group Admin Read/Write permissions.	N/A	The user can view which group they belong to and their current role (i.e. the information presented on the Profile section).
Group Routing	The user can adjust group routing for their children groups. Users will not be able to adjust their own group's routing as this is potentially assigned by their parent group.	The user can view their group's group routing table.	The user cannot view the group routing table.
Zone & Routing	The user can create new Zones within the group and assign routes to them. The zone's routes must be an appropriate subnet of an assigned group route.	The user can view zones and their assigned subnets.	The user cannot view zone routing information.
Mitigation Reporting	The user can query and view traffic statistics within their group's zones, as well as view and schedule reports.	The user can query and view zone statistics, and view previously generated reports.	N/A
Mitigation Config	The user can change mitigation configuration settings within their group's zones.	The user can view mitigation configuration settings within their group's zones.	The user cannot view any zone mitigation configuration.
Limit Resource	The user can make changes that consume limited resources on devices, like Force On mode for AT1. The full list includes: AT1 Force On Mode Block List Source Allow List Destination Allow List	N/A	The user cannot configure device limited resources.
rWeb	The user can make changes to rWeb's configuration.	N/A	The user has no access to rWeb's configuration.
Device	The user can add devices or change their configuration. This permission is also required to be able to perform a tcpdump.	The user can view devices, their current configuration, and their current status.	The user will see no information pertaining to attached filter devices.

Special Permissions

Some permissions don't fall neatly under Read/Write, Read Only, or None. The specifics of those permissions are described here.

Permission	Type	Description
Mitigation Config	Template Only	Users can view and adjust mitigation configuration, but only by selecting from available Templates. Users with this permission will not be able to adjust individual controls or create new templates.