ZITADEL Managers

Managers are human users or service users who have permission to manage resources within ZITADEL.

Manager permissions can be assigned to different levels in ZITADEL:

• IAM Managers: This is the highest level. Users with IAM Manager roles are able to manage the whole Instance.
• Org Managers: Managers in the Organization Level are able to view or manage everything, according to their permissions, within the granted Organization.
• Project Mangers: In this level the user is able to manage a project.
• Project Grant Manager: The project grant manager is for granted projects by another organization.

Scope of the managers is restricted based on their level. That means a Manager, assigned to one organization, will only get access to resources and configurations of that organization. Only Managers on the instance level can view resources, such as users, across all organizations.

To configure managers in ZITADEL go to the resource where you like to add it (e.g Instance, Organization, Project, GrantedProject). In the right part of the console you can finde MANAGERS in the details part. Here you have a list of the current managers and can add a new one.

When adding a new manager, you can select multiple roles some of which are only allowed to read data. This can be especially useful if you add service users for one of your projects where you only need read access.

Per default you will only search for users within the selected organization. If you like to give a role to a user outside the organization you need to switch to the global search and type the exact loginname of the users. This will prevent users from guessing users from other organizations.

Roles

Name	Role	Description
IAM Owner	IAM_OWNER	Manage the IAM, manage all organizations with their content
IAM Owner Viewer	IAM_OWNER_VIEWER	View the IAM and view all organizations with their content
IAM Org Manager	IAM_ORG_MANAGER	Manage all organizations including their policies, projects and users
IAM User Manager	IAM_USER_MANAGER	Manage all users and their authorizations over all organizations
IAM Admin Impersonator	IAM_ADMIN_IMPERSONATOR	Allow impersonation of admin and end users from all organizations
IAM Impersonator	IAM_END_USER_IMPERSONATOR	Allow impersonation of end users from all organizations
IAM Login Client	IAM_LOGIN_CLIENT	Get all permissions needed to implement your own Login UI.
Org Owner	ORG_OWNER	Manage everything within an organization
Org Owner Viewer	ORG_OWNER_VIEWER	View everything within an organization
Org User Manager	ORG_USER_MANAGER	Manage users and their authorizations within an organization
Org User Permission Editor	ORG_USER_PERMISSION_EDITOR	Manage user grants and view everything needed for this
Org Project Permission Editor	ORG_PROJECT_PERMISSION_EDITOR	Grant Projects to other organizations and view everything needed for this
Org Project Creator	ORG_PROJECT_CREATOR	This role is used for users in the global organization. They are allowed to create projects and manage them.
Org Admin Impersonator	ORG_ADMIN_IMPERSONATOR	Allow impersonation of admin and end users from the organization
Org Impersonator	ORG_END_USER_IMPERSONATOR	Allow impersonation of end users from the organization
Project Owner	PROJECT_OWNER	Manage everything within a project. This includes to grant users for the project.
Project Owner Viewer	PROJECT_OWNER_VIEWER	View everything within a project.
Project Owner Global	PROJECT_OWNER_GLOBAL	Same as PROJECT_OWNER, but in the global organization.
Project Owner Viewer Global	PROJECT_OWNER_VIEWER_GLOBAL	Same as PROJECT_OWNER_VIEWER, but in the global organization.
Project Grant Owner	PROJECT_GRANT_OWNER	Same as PROJECT_OWNER but for a granted proejct.

Configure roles

If you run a self hosted ZITADEL instance you can define your custom roles by overwriting the defaults.yaml In the InternalAuthZ section you will find all the roles and which permissions they have.

Example:

InternalAuthZ:
  RolePermissionMappings:
    - Role: "IAM_OWNER"
      Permissions:
        - "iam.read"
        - "iam.write"

Manager Permission Matrix

This table is generated dynamically from our configuration file.

Permission	IAM_ADMIN_IMPERSONATOR	IAM_END_USER_IMPERSONATOR	IAM_LOGIN_CLIENT	IAM_ORG_MANAGER	IAM_OWNER	IAM_OWNER_VIEWER	IAM_USER_MANAGER	ORG_ADMIN_IMPERSONATOR	ORG_END_USER_IMPERSONATOR	ORG_OWNER	ORG_OWNER_VIEWER	ORG_PROJECT_CREATOR	ORG_PROJECT_PERMISSION_EDITOR	ORG_SETTINGS_MANAGER	ORG_USER_MANAGER	ORG_USER_PERMISSION_EDITOR	ORG_USER_SELF_MANAGER	PROJECT_GRANT_OWNER	PROJECT_GRANT_OWNER_VIEWER	PROJECT_OWNER	PROJECT_OWNER_GLOBAL	PROJECT_OWNER_VIEWER	PROJECT_OWNER_VIEWER_GLOBAL	SELF_MANAGEMENT_GLOBAL	SYSTEM_OWNER	SYSTEM_OWNER_VIEWER
action.execution.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
action.execution.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
action.target.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
action.target.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
action.target.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
admin.impersonation	yes	no	no	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
events.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
group.create	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
group.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
group.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no
group.user.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
group.user.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no
group.user.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
group.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.action.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.action.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.action.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.debug.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.debug.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.feature.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.feature.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.feature.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.flow.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.flow.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.flow.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.idp.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.idp.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.idp.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.member.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.member.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.member.write	no	no	yes	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.policy.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.policy.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.policy.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.restrictions.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.restrictions.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.web_key.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.web_key.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.web_key.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
iam.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
impersonation	yes	yes	no	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
milestones.read	no	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.action.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.action.read	no	no	no	yes	yes	yes	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.action.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.create	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no	no
org.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.feature.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
org.feature.read	no	no	yes	yes	yes	yes	no	no	no	yes	yes	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
org.feature.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
org.flow.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.flow.read	no	no	no	yes	yes	yes	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.flow.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.global.read	no	no	no	yes	yes	no	yes	no	no	yes	no	no	no	no	no	no	no	yes	no	yes	yes	no	no	no	no	no
org.idp.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
org.idp.read	no	no	yes	yes	yes	yes	no	no	no	yes	yes	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
org.idp.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
org.member.delete	no	no	no	yes	yes	no	yes	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.member.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	yes	no	yes	no	no	no	no	no	no	no	no	no	no
org.member.write	no	no	yes	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
org.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	yes	yes	yes	no	no	no	no	no	no	no	no	no	no
org.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
policy.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
policy.read	no	no	yes	yes	yes	yes	no	no	no	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	yes	no	no
policy.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no
project.app.delete	no	no	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.app.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	no	yes	no	no	no	yes	yes	yes	yes	no	no	no
project.app.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.create	no	no	no	yes	yes	no	no	no	no	yes	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no
project.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.grant.delete	no	no	no	yes	yes	no	yes	no	no	yes	no	no	yes	no	no	no	no	no	no	yes	no	no	no	no	no	no
project.grant.member.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	yes	no	yes	no	no	no	no	no	no
project.grant.member.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	no	yes	no	yes	yes	yes	no	yes	yes	no	no	no
project.grant.member.write	no	no	yes	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	yes	no	yes	no	no	no	no	no	no
project.grant.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	no	yes	no	yes	yes	yes	no	yes	yes	no	no	no
project.grant.user.grant.read	no	no	no	no	no	no	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
project.grant.write	no	no	no	yes	yes	no	yes	no	no	yes	no	no	yes	no	no	no	no	no	no	yes	no	no	no	no	no	no
project.member.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.member.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	no	yes	no	no	no	yes	yes	yes	yes	no	no	no
project.member.write	no	no	yes	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	yes	yes	no	yes	yes	yes	yes	yes	yes	no	no	no
project.read:self	no	no	no	no	no	no	no	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no
project.role.delete	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.role.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	yes	yes	no	no	no	yes	yes	yes	yes	no	no	no
project.role.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
project.write	no	no	no	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	yes	yes	no	no	no	no	no
session.delete	no	no	yes	yes	yes	no	yes	no	no	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
session.link	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
session.read	no	no	yes	yes	yes	yes	yes	no	no	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
session.write	no	no	yes	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
system.debug.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.debug.read	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	yes
system.debug.write	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.domain.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.domain.read	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	yes
system.domain.write	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.feature.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.feature.read	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	yes
system.feature.write	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.iam.member.read	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	yes
system.instance.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.instance.read	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	yes
system.instance.write	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.limits.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.limits.write	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.quota.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
system.quota.write	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no
user.credential.write	no	no	yes	yes	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
user.delete	no	no	no	yes	yes	no	yes	no	no	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
user.feature.delete	no	no	no	yes	yes	no	yes	no	no	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
user.feature.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
user.feature.write	no	no	no	yes	yes	no	yes	no	no	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
user.global.read	no	no	no	yes	yes	yes	yes	no	no	yes	yes	yes	yes	no	yes	yes	no	yes	yes	yes	yes	yes	yes	no	no	no
user.grant.delete	no	no	no	yes	yes	no	yes	no	no	yes	no	no	yes	no	yes	yes	no	yes	no	yes	yes	no	no	no	no	no
user.grant.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	yes	yes	no	yes	yes	yes	yes	yes	yes	no	no	no
user.grant.write	no	no	yes	yes	yes	no	yes	no	no	yes	no	no	yes	no	yes	yes	no	yes	no	yes	yes	no	no	no	no	no
user.membership.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	no	no	yes	no	no	yes	yes	yes	yes	yes	yes	no	no	no
user.passkey.write	no	no	yes	yes	yes	no	yes	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
user.read	no	no	yes	yes	yes	yes	yes	no	no	yes	yes	no	yes	no	yes	yes	no	yes	yes	yes	no	yes	no	no	no	no
user.self.delete	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	yes	no	no	no	no	no	no	yes	no	no
user.write	no	no	yes	yes	yes	no	yes	no	no	yes	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no
userschema.delete	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
userschema.read	no	no	yes	no	yes	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no
userschema.write	no	no	no	no	yes	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no	no