What are Permission Groups?

In CloudCannon, Permissions control what actions your Team Members can perform within your Organization. The Permission Group a Team Member belongs to determines their Permissions.

A Permission Group defines a set of Permissions for each member of that Group. Every Team Member in your Organization must be a member of at least one Group. When you invite a Team Member to your Organization, CloudCannon will prompt you to select a Permission Group to add them to.

CloudCannon provides several Default Permission Groups, but you can create Custom Permission Groups on the Team and Enterprise Plans. You can see the full list of Permission Groups in your Organization on the Groups tab of the Team page, under Org Settings.

What is a permission?#

All Permission Groups consist of a list of Permissions. Permissions define which Resources the members can access, the Scopes those Resources apply to, and the actions members can take with regard to those Resources.

• Resource — Anything a Team Member could possibly interact with in CloudCannon. A Resource could be an individual Site, Pull Request settings, billing information, and more.
• Scope — This defines how broadly a Permission is applied across an Organization in CloudCannon. Every Permission in a Permission Group has a single Scope from one of five levels: Global, Project, Site, Group, and Base Domain. Which Scopes are available will depend on whether you are using Default or Custom Permission Groups.

Each Resource in a Permission Group also has one or more associated actions: Read, Write, or Create.

• Read — The capacity to see a Resource and open it to view its contents. Read is the most basic level of a Resource. If you do not have Read for a particular Resource, that Resource will not appear anywhere in CloudCannon.
• Write — The capacity to edit a Resource. If you have Write for a particular Resource, CloudCannon will automatically allow you to Read.
• Create — The capacity to create more instances of a Resource. Create only applies to a few Resources. When you create an instance of a Resource, CloudCannon will automatically give you permission to Read and Write that instance.

For a complete list of Resources and their associated Scopes and actions, please read our Permissions reference documentation.

Default Permission Groups#

CloudCannon provides several Default Permission Groups:

• Five Groups with Global Scope (Owners, Developers, Technical Editors, Editors, and Billing)
• Two Groups per Site with Site Scope for Site Sharing
• One Group per Site with Site Scope for Client Sharing

Each of these Permission Groups has a defined set of Permissions so that you can select the appropriate level of control for each Team Member. You cannot edit the Resources or Scope of Default Permission Groups. Members of the Owners or Developers Permission Group can invite Team Members to your Organization and update which Permission Group Team Members belong to.

For more information, please read our documentation on what Default Permission Groups are.

Custom Permission Groups#

On the Team and Enterprise Plans, you can create Custom Permission Groups, which give you fine-grained control over the Permissions in your Organization.

Using Custom Groups, you can add multiple Permissions to a Group and alter the Scope of each Permission from Global to Project, Site, Group, or Base Domain. You can also define File Globs and Exceptions for each Group for more precise Permissions.

A file glob is a pattern that matches a set of files, so you can grant access to specific folders or file types rather than an entire Site. For example, you could let a Team Member edit only the blog posts on a Site, and nothing else.

An Exception lets you grant a broad Permission and then take it away for specific Resources. For example, you could give a Team Member permission to edit every Site in a Project except your live Site.

For more information, please read our documentation on what Custom Permission Groups are.

Multiple Permission Groups#

You can be a member of multiple Permission Groups.

Permission Groups are always additive. In other words, Permissions from one Group do not negate Permissions from another. CloudCannon will allow an action if a Team Member has permission from at least one Group.

Here is an example.

You are a member of Permission Group A, allowing you to access the Source Editor editing interface. You are also a member of Permission Group B, which does not include permission to use the Source Editor. In this example, CloudCannon will still allow you to use the Source Editor because you have permission to do so from at least one Permission Group.

The additive nature of Permission Groups is less relevant for four of the Default Permission Groups (Owners, Developers, Technical Editors, and Editors), because each Group also contains the Permissions of all Groups below it. However, the Billing Group sits outside this hierarchy: if you belong to both the Technical Editors and Billing Groups, you can manage billing through your Billing Group membership, even though your Technical Editors Group has no billing Permissions.

Finally, Exceptions from one Custom Permission Group do not prevent you from accessing a Resource if you have permission to do so from a second Permission Group.

Partner Permission Groups#

The CloudCannon Partner Program allows agencies or freelancers specializing in web design/development to set up their clients in CloudCannon.

CloudCannon will automatically add Owners from a Partner Organization to linked Client Organizations as members of a special Partner Permission Group. Partner Organization Owners can add Team Members to a Client Organization, allowing them to give developers from their agency access to their client's Sites.

Partner Organization members in a Client Organization do not contribute to the maximum number of Team Members allowed per Organization and, therefore, do not affect billing for the Client Organization.