Permissions

The complete set. Permissions are granted through roles, and a role holding * is a superuser within its tenant.

The same checks run on the web console, the REST API, the MCP server and the assistant.

Loans

Key	Allows
loan.view	See loans and who has what
loan.issue	Issue a loan device
loan.return	Mark a loan returned
loan.manage	Register devices, edit, bulk actions, manage loan groups

Devices and inductions

Key	Allows
device.view	See device records and history
device.manage	Send MDM commands, including wipe
induction.manage	Run inductions, import rosters, record issued devices

Repairs

Key	Allows
repair.view	See submissions
repair.create	Lodge one
repair.update	Change status, priority, assignment, add notes
repair.close	Close one, record outcome and cost

Tickets

Key	Allows
ticket.view	See tickets
ticket.create	Raise one
ticket.update	Change status, queue, assignment
ticket.comment	Reply publicly
ticket.internal	Read and write internal notes
ticket.close	Close one

Stock and money

Key	Allows
stock.manage	Maintain the catalogue and sell items
cost.view	See cost analytics
cost.export	Export cost data
charge.view	See damage charges
charge.raise	Propose a charge
charge.approve	Approve, decline or waive a charge

People and directory

Key	Allows
client.view	See people and their profiles
client.manage	Edit person records, register cards
directory.view	Search the identity provider
directory.manage	Licences, lock, delegate, reset passwords

Administration

Key	Allows
user.manage	Create and deactivate staff accounts
role.manage	Create roles and change what they hold
connector.manage	Configure connectors and credentials
branding.manage	Change name, logo and colours
feature.manage	Enable and disable modules
workflow.manage	Statuses, priorities, types, coverages, parts
billing.manage	Enter or remove a licence key
integration.manage	Issue API keys, manage webhooks
audit.view	Read the audit log

Operations

Key	Allows
monitor.view	See service monitors
monitor.manage	Create and configure monitors
backup.view	See backup history
backup.manage	Schedule, run, verify and export backups
kb.manage	Write and publish knowledge base articles
report.view	Run and export reports
report.manage	Create and schedule reports

The deliberate splits

Two permissions exist as separate keys for reasons worth knowing.

ticket.internal separates the desk’s own notes from working the queue. An internal note is where somebody writes “third time this term, escalate” or “her mother rang, do not put this in writing”, so a school can hand a casual or a student helper the queue without handing them that.

charge.raise and charge.approve separate proposing a charge from making it real. A technician who can propose must not be able to bill a family, and because the person who decides a family pays is the person who can decide they do not, waiving sits with approval rather than with raising.

The two to be careful with

device.manage allows wipes, which destroy a student’s data and cannot be undone.

directory.manage allows password resets and mailbox delegation in your identity provider. It is effectively an account takeover capability.

Wildcard

A role holding * has every permission within its tenant. There is no permission anywhere that crosses a tenant boundary.

API key scopes

API keys carry scopes from this same set. A key cannot exceed them, and on the MCP server a key without a permission does not even see the corresponding tool in tools/list.