Key Concepts¶

Overview¶

RBAC controls access by assigning permissions through roles. CloudVerse also supports access scopes for users who should see only selected Dynamic Perspective data.

Who can use this¶

Admins and delegated users with organization access permissions can use these concepts to plan roles and user access.

Before you begin¶

Review the user's job responsibilities and decide whether they need broad access, read-only access, or scoped access to specific perspectives.

Core terms¶

Term	Meaning
User	A person who can sign in to CloudVerse.
Tenant User	A user whose email domain matches the tenant organization domain.
External User	A user whose email domain does not match the tenant organization domain.
Role	A named set of permissions assigned to one or more users.
Built-in role	A CloudVerse-provided role. Built-in roles cannot be edited or deleted from the role table.
Custom role	A role created by an admin for the tenant. Custom roles can be edited or deleted.
Permission	A specific action on a product area, such as view, add, modify, delete, activate, or deactivate.
Access scope	A set of Dynamic Perspective filters that limits what a `Perspective User` can see.
Effective scope	The final scope applied after CloudVerse combines the user's allowed scope with request filters.

Built-in roles¶

CloudVerse includes built-in roles for common administration, finance, engineering, executive, and scoped-user patterns. The exact roles available can vary by tenant configuration.

Tenant Admin
Perspective Admin
Tenant User
Asset Admin
Executive User
Perspective User
Partner Customer Admin
Partner Tenant Admin

Tenant users and external users¶

When adding a user, choose one user type:

Select Tenant User if the user's email domain matches your organization domain.
Select External User if the user's email domain is outside your organization domain.

CloudVerse validates the email domain:

Tenant users must use the organization domain.
External users cannot use the organization domain.

Roles and permissions¶

Roles contain privileges. In the custom role form, privileges are selected from a table with:

Privileges
Permissions

Permissions are selected as checkboxes, such as View, Add, Modify, Delete, Activate, and Deactivate.

Access scopes¶

Access scopes apply to users with the Perspective User role. A scope can limit access by dimensions such as:

Provider
Account
Region
Service
Tag
Billing Account
Resource Group

Expected result¶

Users inherit access from their assigned roles. If a user also has a Dynamic Perspective scope, CloudVerse limits the user's visible cost data to that scope.

Notes and limitations¶

Removing Perspective User from a user with a configured scope shows a warning that the scope will be removed.
Access is granted through roles and configured scopes. If a user is missing access, add the needed permission or scope rather than relying on an explicit deny rule.