Ownership of Objects

Last updated: October 22, 2026

The term "owner" is used two different ways in Kion.

Permissions

The first way refers to a permission role named Owner. In earlier versions of Kion, Owner was a default role. It has been replaced by the built-in, system-managed Admin role. If your Owner role had been customized, it was kept as a user-managed role. You can map users and user groups to permission roles in permission schemes. The permissions granted to users with a role are based on the permissions mapped to the role. For more information, see Built-In Permission Roles.

Objects and Resources

The second way refers to ownership of certain objects, which is designated during object creation. The objects that use this type of ownership are:

  • Cloud Rules

  • IAM Policies

  • Azure Role Definitions

  • Azure Policy Definitions

  • GCP IAM Roles

  • AWS CloudFormation Templates

  • Azure ARM Templates

  • AWS Service Catalog Portfolios

  • AWS Service Control Policies

  • AWS AMIs

  • Webhooks

  • Compliance Checks

  • Compliance Standards

  • Automation Policies

  • Custom Variables

  • User Groups

Capabilities granted by object ownership are separate from permission roles/permission schemes.

The capabilities granted by object ownership are fixed and cannot be changed. Only object owners may edit an object.

Users with object creation permissions are not automatically added as object owners for the objects they create. For example, a user can have project creation permissions granted to them through a permission scheme, but they won't be able to edit/delete projects they create unless they are also added as an owner. Conversely, if a user who cannot create projects is made an owner of a project, they can make edits that project but still cannot create or edit other projects.