Permission Levels

Different consumers and workflows interact with Bifrost in different ways, from read-only analytics pipelines to services that actively manage the fleet.

To follow the principle of least privilege, Bifrost separates access into three progressive permission levels: viewer, editor, and owner. Each level builds on the previous one, allowing you to grant a user or service only the capabilities it needs without exposing broader management or destructive operations.

Roles

During onboarding, we deploy three IAM roles in the Bifrost account for your business unit, one for each permission level:

• Viewer: Provides read-only access to inspect resources and consume telemetry data without modifying anything on the platform (bifrost-prod-viewer-{businessUnitKey}-role).
• Editor: Includes all viewer permissions, plus day-to-day operational capabilities to register and manage resources belonging to your business unit (bifrost-prod-editor-{businessUnitKey}-role).
• Owner: Includes all editor permissions, plus elevated control for high-impact and destructive operations (bifrost-prod-owner-{businessUnitKey}-role).

info

The {businessUnitKey} placeholder refers to the key provided in Pre-flight. AWS resources are named after it for consistency.

Roles are not split by service or interface. Once you assume a role for your permission level, you use those same credentials to consume the telemetry stream and to call the Bifrost APIs. How to assume a role and sign requests is covered in Authenticating and Making API Requests.

Alongside the business unit roles, we maintain a platform-wide admin role (bifrost-{env}-admin-role). Rather than being scoped to a business unit, this role is reserved for platform administration and can perform any operation in Bifrost, including tasks restricted from business unit roles such as updating controller schemas.

Operations matrix

When you choose a role for an integration or a user, match it to the actions that workflow needs to run. The matrix below shows which operations each permission level can perform and where an action is scoped to your business unit's own devices.

Operation	Viewer	Editor	Owner	Admin
Read telemetry Via Data API and Kinesis stream	✅ Own business unit only	✅ Own business unit only	✅ Own business unit only	✅ Any business unit
List devices	✅ Own business unit only	✅ Own business unit only	✅ Own business unit only	✅ Any device
Get a device	✅ Own business unit only	✅ Own business unit only	✅ Own business unit only	✅ Any device
Create a new device	❌	✅ Own business unit only	✅ Own business unit only	✅ Any device
Update a device	❌	✅ Own business unit only	✅ Own business unit only	✅ Any device
Update the environment of a device	❌	✅ Own business unit only	✅ Own business unit only	✅ Any device
Decommission a device	❌	✅ Own business unit only	✅ Own business unit only	✅ Any device
Delete a device	❌	❌	✅ Own business unit only	✅ Any device
Issue a command	❌	✅ Own business unit only	✅ Own business unit only	✅ Any device
Issue a firmware update	❌	❌	✅ Own business unit only	✅ Any device
Update the business unit of a device	❌	❌	❌	✅ Any device
Update the telemetry schema of a controller	❌	❌	❌	✅