Roles and Permissions
info
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
Concept: organization
An organization is a top-level hierarchy of Shisho Cloud. It basically corresponds to a company, and it includes all the resources and users.
Roles
Roles | Description |
---|---|
organization/owner | An owner of the entire organization, able to perform all actions on the organization. |
organization/member | A member of the organization with least permissions on the organization. |
organization/auditor | An auditor of the organization, able to view all the resources and users in the organization but not able to make any changes. |
organization/triager | A triager, able to view risk statistics and details of each finding and triage these findings. |
organization/browser | A browser of the organization, able to view all resources in the organization without risk statistics |
organization/user_browser | A user browser of the organization, able to view all users and teams in the organization |
organization/assessor | An assessor of the organization, able to view all resources in the organization for assessment |
organization/integration_manager | An integration manager of the organization, able to manage integrations |
organization/takumi_manager | A takumi manager of the organization, able to manage takumi-related features |
Permissions
Permission | Description |
---|---|
bot.create_trust_conditions | Create a trust condition |
bot.delete | Delete the bot |
bot.delete_trust_conditions | Delete a trust condition |
bot.list_trust_conditions | List trust conditions of the bot |
bot.update_info | Update basic information of the bot |
bot.view_info | View basic information of the bot |
integration.delete | Delete the integration |
integration.edit | Update the integration |
integration.get_github_access_token | Get a GitHub access token from resources |
integration.view | View basic information of the integration |
notification_group.delete | Delete the notification group |
notification_group.edit | Update configuration of the notification group |
notification_group.view | View configuration of the notification group |
organization.create_bot | Create a bot |
organization.create_integration | Create an integration |
organization.create_notification_group | Create a notification group |
organization.create_project | Create a Shisho Cloud project |
organization.create_sso | Add a SSO configuration |
organization.create_team | Create a team |
organization.create_workflow | Create a workflow |
organization.delete_address_from_email_allowlist | Delete an email address from the email allowlist |
organization.delete_custom_decision_specification | Delete a custom decision specification |
organization.delete_organization | Delete an organization |
organization.delete_project | Delete a Shisho Cloud project |
organization.delete_sso | Delete a SSO configuration |
organization.delete_team | Delete a team |
organization.describe_decision_specification | Describe a decision specification |
organization.dispatch_workflow | Dispatch the workflow |
organization.invite_user | Send a user invitation |
organization.kick_user | Kick a user |
organization.list_bots | List bots |
organization.list_custom_decision_specification | List custom decision specifications |
organization.list_integration | List integrations |
organization.list_invitation | List invitations |
organization.list_notification_group | List notification groups |
organization.list_project | List Shisho Cloud projects |
organization.list_sso | List SSO configurations |
organization.list_team | List teams |
organization.list_user | List users, including the permissions |
organization.list_workflow | List workflows |
organization.list_workflow_run | List workflow runs |
organization.manage_custom_decision_specification | Create and update a custom decision specification |
organization.query_real_data | Query a GraphQL API to get real data integrated to Shisho Cloud |
organization.register_address_to_email_allowlist | Add an email address to the email allowlist |
organization.send_confirmation_to_mail_owner | Send a confirmation email to the email address owner |
organization.triage_decision | Triage a finding |
organization.update_iam | Grant/revoke roles or permissions to/from organization members |
organization.update_settings | Update organization settings |
organization.use_datasource_playground | Use a datasource playground |
organization.verify_notification_channel | Verify a notification channel is working |
organization.view_basic_info | View organization basic information |
organization.view_dashboard | View a dashboard with risk statistics without any resource details |
organization.view_decision | View risk statistics and details of each finding with resource details |
organization.view_email_allowlist | View the email allowlist |
organization.view_resource | List and describe resources integrated to Shisho Cloud with risk statistics |
organization.view_resource_analysis | View resource risk analysis |
organization.view_settings | View organization settings |
organization.view_workflow_run | View a workflow run |
trust_condition.delete | Delete the trust condition |
trust_condition.update | Update the trust condition |
trust_condition.view | View the trust condition |
workflow.delete | Delete the workflow |
workflow.dispatch | Run the workflow |
workflow.edit | Update the workflow |
workflow.view | View the workflow |
workflow_run.view | View the workflow run, including exit codes and the output of the run |
workflow_snapshot.view | View the workflow snapshot |
Roles and Permissions Matrix
Permission | organization/assessor | organization/auditor | organization/browser | organization/integration_manager | organization/member | organization/owner | organization/takumi_manager | organization/triager | organization/user_browser |
---|---|---|---|---|---|---|---|---|---|
bot.create_trust_conditions | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
bot.delete | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
bot.delete_trust_conditions | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
bot.list_trust_conditions | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
bot.update_info | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
bot.view_info | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
integration.delete | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
integration.edit | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
integration.get_github_access_token | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
integration.view | ❌ | ✅ | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
notification_group.delete | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
notification_group.edit | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
notification_group.view | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.create_bot | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.create_integration | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.create_notification_group | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.create_project | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.create_sso | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.create_team | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.create_workflow | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.delete_address_from_email_allowlist | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.delete_custom_decision_specification | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.delete_organization | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.delete_project | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.delete_sso | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.delete_team | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.describe_decision_specification | ❌ | ✅ | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ | ❌ |
organization.dispatch_workflow | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.invite_user | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.kick_user | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.list_bots | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.list_custom_decision_specification | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ |
organization.list_integration | ❌ | ✅ | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.list_invitation | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.list_notification_group | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ❌ |
organization.list_project | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.list_sso | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.list_team | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ✅ |
organization.list_user | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ✅ | ✅ | ✅ |
organization.list_workflow | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.list_workflow_run | ❌ | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ |
organization.manage_custom_decision_specification | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.query_real_data | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.register_address_to_email_allowlist | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.send_confirmation_to_mail_owner | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ |
organization.triage_decision | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ |
organization.update_iam | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ |
organization.update_settings | ❌ | ❌ | ❌ |