Built-In Permission Roles

Kion ships with a set of built-in permission roles that cover the most common personas in a cloud program. You can assign them to users and user groups the moment Kion is installed, without building roles from scratch.

This article describes each built-in role, what it's meant for, and how it behaves when Kion is upgraded.

New to Kion permissions? A permission role is a named job function (such as "FinOps Manager"). A permission scheme maps individual permissions to each role and is applied to an object, such as an OU, project, or funding source. To learn more, see Permissions Basic Concepts and Permission Assignment Flow.

At a Glance

Role Details

Admin

Full access to every part of Kion, including system settings, permissions, users and user groups, identity management systems (IDMS), billing sources, and all OUs, projects, and funding sources.

• Installation creates a default Admin user and an Administrators user group with this role.

• Assign it sparingly. Most people need a narrower role.

User

The standard role for people who use Kion to reach their cloud environments.

• Browse OUs, projects, funding sources, cloud accounts, cloud rules, cloud access roles, compliance results, financials, and reports.

• Submit project access requests and project creation requests.

• Request cloud rule exemptions and compliance finding suppressions.

• Create and rotate their own app API keys.

Power User

Everything in User, plus the ability to organize work:

• Create and edit OUs and projects, including descendant OUs and projects on OUs where the role is assigned.

• Create and manage resource policies (cloud resource IAM and template definitions).

• Create custom variables.

• Browse OU and project automation policies.

Read-Only/Auditor

Visibility across Kion with no ability to make changes. Suited to auditors, leadership, and oversight functions.

• Browse everything a User can, plus system settings, permissions, billing sources, users, user groups, and IDMS, and the audit log.

• Browse billing source and user reports.

• Can't submit requests or create API keys.

FinOps Manager

Day-to-day management of Kion's financial features.

• Manage funding sources, funding source allocations, and fund transfers.

• Manage billing sources.

• Manage budgets and spend plans on OUs and projects.

• Manage financial enforcements on funding sources, OUs, and projects.

• View and address savings opportunities, and manage reserved instances.

• Manage scopes.

• Browse all financial and spend reports.

Security & Compliance User

Management of the guardrails that govern your cloud environments.

• Manage cloud rules and apply them to OUs and projects.

• Manage cloud access roles on OUs and projects, plus long-term access keys and AWS API keys.

• Manage cloud policy definitions: AWS IAM policies, service control policies, CloudFormation templates, Service Catalog portfolios, and shared AMIs; Azure policies, roles, and ARM templates; and Google Cloud IAM roles.

• Manage compliance checks and standards, and review compliance finding suppression and cloud rule exemption requests.

• Manage action plans, actionable labels, webhooks, app API keys, and custom variables.

• Review project access requests.

• Browse users, user groups, IDMS, and the audit log.

This role has no funding source permissions.

AI User

Gives access to Lux, Kion's in-app AI agent.

• Grants exactly one permission: Use Lux AI Agent.

• Lux can only see and do what the user's other roles already allow. Assigning AI User doesn't expand anyone's access to Kion data or actions.

• Assign it alongside another role (for example, User + AI User).

System-Managed vs. User-Managed Roles

All of the roles above are system-managed:

• Kion keeps them up to date. When a new Kion release adds permissions that fit a built-in role, the role picks them up automatically, and so does everyone assigned to it.

• Cloning makes a user-managed copy. To customize a built-in role, clone it and edit the copy. The copy won't receive future permission updates; you maintain it.

Upgrading from an older version of Kion? Earlier versions shipped with an Owner role. If you never modified Owner, it became Admin when you upgraded. If you did modify it, Kion kept your version as a user-managed role named Owner and assigned your users to it, so their access didn't change.

Where Built-In Roles Apply

Each built-in role is mapped in Kion's default permission schemes, so it works at every level of the hierarchy:

A role assigned at the global level applies everywhere. A role assigned on an OU, project, or funding source applies only to that object, and for OUs, to its descendants where the permission inherits.

See Exactly What a Role Grants

To view every permission a role includes, including implied permissions:

1. Go to Settings > Permissions.

2. Select the Roles tab.

3. Click a role.

4. Review the Mapped Permission Schemes section. For each permission scheme the role is mapped in, it lists the role's Applied permissions and the Implied permissions that come with them.

What Next?

• What are Permission Roles?

• Managing Permission Roles

• Create a Permission Role

• What are Permission Schemes?

• Built-In Resources