Residency Admin
The Residency Admin decides where data may live. Data residency is held at configure, so this role sets the residency of an inventory, which every resource in it inherits, and the residency of an individual resource where that differs. It is the only thing this role can change, and because the permission is held at configure rather than in full, it cannot decide who else reaches it.
Inventories can be inspected but not changed. Every other resource class is out of reach, as are the organization, its members, the audit log, and both legal holds.
Organization
| Permission | Access |
|---|---|
| Organization | No access |
| Members | No access |
| Audit log | No access |
| Data residency | Configure |
| Restore points legal holds | No access |
| Inventory resources legal holds | No access |
Resources
| Permission | Access |
|---|---|
| Inventories | View |
| Apps | No access |
| Restore point data | No access |
| Secret Providers | No access |
| Integrations | No access |
| Policies | No access |
| Settings | No access |
| Edges | No access |
| Configuration bundles | No access |
| Data classes | No access |
| Environments | No access |
| Schedules | No access |
Deployment
| Permission | Access |
|---|---|
| Control plane | No access |
| License | No access |