Permissions and the API
Who may do what
| To | Permission | Held by |
|---|---|---|
| See changes on the services of your units | change.read | Agent, Viewer, Auditor, Change Manager, Change Approver |
| Record changes, edit them before they start, carry out your own | change.write | Agent, Change Manager |
| Be one of the approvers a policy asks | change.approve | Change Manager, Change Approver |
| Set the risk by hand on others' changes, cancel them, proceed without a customer | change.manage | Change Manager |
| Hold and chair CAB meetings | change.manage | Change Manager |
| Put a change under legal hold | case.legal_hold | Administrator |
| Standard change templates | change.template | Change Manager |
| Settings and approval policies | change.settings | Change Manager |
A service's owner may approve as its owner without change.approve.
For AI assistants and the API
Tokens can get changes:read, changes:write and changes:approve. AI assistants can list and read changes, draft
and edit them, send them for approval, make standard changes from templates, ask the gate, and start and finish them,
within the same permissions. They can never approve a change or a template. Webhooks hear changes.created,
changes.submitted, changes.approved, changes.rejected, changes.started, changes.finished, changes.closed and changes.cancelled. The API is in
building a plugin.