Roles and access

Your Cmdop organization role does not decide what may happen on a machine. Three separate gates do: reaching the relay, attaching to that machine, and the machine’s own permission policy for the requested action. Each has its own credential. When something is refused, read the machine’s permission audit, not anyone’s org role.

If you are trying to work out why something was or was not allowed on a machine, your organization role is not the answer. Machines decide for themselves.

The three gates a request passes

1. Can you reach the relay? A browser on the relay’s own host is recovered through the loopback policy. Anyone else supplies the relay’s admin password or a one-time sign-in link.
2. Can you attach to that machine? Attaching to a machine remotely can additionally require its connection PIN, armed per machine.
3. May the requested action run? The machine’s permission policy decides — its mode, its rules, and the OS-level directories it has been granted. See Permissions.

Each gate has its own credential. They are separate planes on purpose: rotating the relay admin password does not rotate the fleet join key or any connection PIN.

Reading the answer

The machine records every permission decision it made — allowed, asked, or denied — with the rule that matched:

cmdop permissions list
cmdop permissions audit

The same policy and recent decisions are readable per machine from Machines in the web console.

Related

• Organizations
• Security
• Audit and logs

Common questions

Do Cmdop organization roles control machine permissions?

No. Organization roles belong to the account and plan surface. Machine access is decided by relay sign-in, machine attach credentials, and the target machine’s permission policy.

Why was an action refused if my org role is admin?

The refusal probably came from one of the machine gates: relay access, machine attach, or the machine’s permission policy. Read cmdop permissions audit on the target before changing organization roles.

Which credential should I rotate after access changes?

Rotate the credential for the plane that changed: relay admin password or one-time links for relay access, connection PIN for one machine, and permission rules for allowed actions. Organization role changes do not rotate those.