> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/powershell-universal/security/enterprise-security/permissions.md).

# Permissions

Manage fine-grained PowerShell Universal permissions, including folder-scoped Automation Script access for delegated teams.

Permissions provide fine-grained authorization for PowerShell Universal resources. Built-in roles have read-only permission sets. Custom roles and individual identities can receive additional permissions. Permissions are stored in the database, not `.universal` configuration files.

## Permission identifiers

A permission identifier combines a scope, resource type, and access type.

```
apis/read
automation.scripts/*
```

Use `*` to include all access types or descendants of a scope. Global resource permissions remain compatible with and authorize the matching scoped resources.

## Manage permissions

Manage identity permissions under **Secure > Permissions**. Permissions assigned directly to an identity combine with those from its assigned roles.

To manage a role's permissions, open **Secure > Roles**, select the role, and select its **Permissions** lock icon. Resource-specific permission dialogs are also available from supported resource pages.

## Folder-level script permissions

Use folder-scoped Automation Script permissions to delegate a portion of the script library without granting access to every script. A folder permission applies to that folder and its nested folders, while preserving folder boundaries. For example, a permission for `Delegated` does not grant access to `Delegated_Private`.

### Create a folder permission

1. Create or select a custom role under **Secure > Roles**.
2. Open **Build > Scripts** and select **Folder** view.
3. Select the target folder, then select the **Permissions** lock icon in the folder toolbar.
4. Create a permission for the identity or role. The resource is pre-scoped to the selected folder, for example `automation.scripts.Delegated/*`.
5. Select the required access and save.

Use **All** to grant Read, Create, Update, and Delete access to scripts in the folder and all nested folders. You can instead grant these permissions individually:

| Access | Allows                                                                        |
| ------ | ----------------------------------------------------------------------------- |
| Read   | Viewing scripts in the permitted folder.                                      |
| Create | Creating scripts and uploading `.ps1` files in the folder.                    |
| Update | Editing, renaming, and moving scripts when all affected paths are authorized. |
| Delete | Deleting scripts in the folder.                                               |
| All    | Read, Create, Update, and Delete in the folder and descendants.               |

A delegated user also needs `automation.scripts` **View** access to open the Scripts page. This page-level permission does not grant access to every script; folder-scoped Read permissions determine which scripts the user sees.

### Moves and renames

Moving or renaming a script requires Update authorization for both the existing source path and the destination path. For example, a user who has Update access to `Delegated` but not `Restricted` cannot move a script from `Delegated` to `Restricted`. Grant Update access to both folders when the user needs to move scripts between them.

PowerShell Universal validates and canonicalizes script paths before it evaluates permissions. Rooted paths, drive-qualified paths, and path traversal are rejected.

## Example: delegated script folder

The following role can open the Scripts page and fully manage scripts under `Delegated`, including nested folders.

```powershell
New-PSURole -Name 'Script Folder Team' -Permission @(
    'automation.scripts/view',
    'automation.scripts.Delegated/*'
)
```

## Default role permissions

* **Administrator**: `*` (full access).
* **Operator**: full access to API, automation, apps, platform, and settings scopes.
* **Execute**: read and execute access to APIs, automation, and apps; read access to platform and settings.
* **Reader**: read access to APIs, apps, and automation.
* **API Editor** and **API Reader**: full or read-only API access.
* **App Editor** and **App Reader**: full or read-only app access.

## API

Use `New-PSURole`, `Get-PSURole`, and `Set-PSURole` to manage role permissions through the PowerShell Universal management API.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.devolutions.net/powershell-universal/security/enterprise-security/permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.