System roles and policies list

This guide describes the Roles and Permissions system. For details on all roles available in the legacy system, see Role-based permissions.

Overview

Cloudinary provides predefined system policies and system roles to help you manage access to features, assets, and operations across your account.

• System policies: Predefined permission policies offered by Cloudinary. These are the building-blocks of all roles. Browse the list of system policies so that you can know which policies to use when building your custom roles. For more information, see Policies and permissions.

• System roles: Built-in roles provided by Cloudinary. They're ready as-is to assign directly to principals (users, groups, or API keys). Browse the list of available system roles and which permissions they grant. For more information, see System roles vs. custom roles.

System policies list

This section lists all system policies provided by Cloudinary, including each policy’s ID, name, and description.

• Understand what your existing roles that include the policies allow.

• Decide which permissions to include in custom roles that you're creating.

• Look up the system_policy_ID to reference the policy you want to include when creating a custom role.

• Examine the policy statements, which define the actions that the policy allows on specific Cloudinary resources, written in Cedar language. For more information, see Understanding the policy_statement.

For more background information about system policies, see Role-based permissions overview.

For more details on system policies, see Manage roles.

Global permissions

Account settings

You can assign the permissions in this section to groups and users through roles. You can also assign these roles to API keys for actions that are available programmatically.

Policy ID	Name	Description	Policy Statement
cld::policy::global::account_information::manage	Manage account information	Edit basic account information, such as account name and product environment display name, in the Console.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::account_information::manage"); permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::Account); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Account);
cld::policy::global::account_api_keys::manage	Manage account management keys	View account management keys that authenticate the Provisioning and Permissions APIs, update their details, and generate new key pairs.	permit(principal, action, resource is Cloudinary::AccountAPIKey); permit(principal, action, resource is Cloudinary::ProvisioningKey); permit(principal, action, resource is Cloudinary::AccountManagementKey); permit(principal, action, resource == Cloudinary::Feature::"cld::global::account_api_keys::manage");
cld::policy::global::product_environments::view	View a product environment	View a specific product environment in the account and its associated details. This doesn't grant access to the product environment or its contents.	permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::ProductEnvironment);
cld::policy::global::product_environments::list	View list of product environments	View a list of all product environments in the account and their associated details. This doesn't grant access to the product environments or their contents.	permit (principal, action == Cloudinary::Action::"list", resource is Cloudinary::ProductEnvironment); permit (principal, action, resource == Cloudinary::Feature::"cld::global::product_environments::view");
cld::policy::global::product_environments::create	Create product environments	Create product environments in the account, and update their associated details. This doesn't grant access to the product environments or their contents.	permit (principal, action == Cloudinary::Action::"create", resource is Cloudinary::ProductEnvironment); permit (principal, action, resource == Cloudinary::Feature::"cld::global::product_environments::create");
cld::policy::global::product_environments::update	Update product environments	Update product environments in the account, and update their associated details. This doesn't grant access to the product environments or their contents.	permit (principal, action == Cloudinary::Action::"update", resource is Cloudinary::ProductEnvironment); permit (principal, action, resource == Cloudinary::Feature::"cld::global::product_environments::update");
cld::policy::global::product_environments::delete	Delete product environments	Delete product environments in the account, and update their associated details. This doesn't grant access to the product environments or their contents.	permit (principal, action == Cloudinary::Action::"delete", resource is Cloudinary::ProductEnvironment); permit (principal, action, resource == Cloudinary::Feature::"cld::global::product_environments::delete");
cld::policy::global::users_and_groups::view	View users and groups	View all users and groups in the account and their group memberships.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::User); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Group); permit(principal, action, resource == Cloudinary::Feature::"cld::global::groups::view"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::users::view");
cld::policy::global::users_and_groups::manage	Manage users and groups	View, add, and remove users and groups in the account, and manage group memberships.	permit (principal, action , resource is Cloudinary::User); permit (principal, action, resource is Cloudinary::Group); permit (principal, action, resource == Cloudinary::Feature::"cld::global::users::view"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::users::create"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::users::update"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::users::delete"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::groups::view"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::groups::create"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::groups::update"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::groups::delete");
cld::policy::global::account_security::view	View account security settings	View account-wide security settings related to authentication, access control, and user privacy.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::account::view"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::Account);
cld::policy::global::account_security::manage	Manage account security settings	Define account-wide security settings related to authentication, access control, and user privacy.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::account::view"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::account::update"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::Account); permit (principal, action == Cloudinary::Action::"update", resource is Cloudinary::Account);
cld::policy::global::roles_permissions::manage	Manage roles and permissions	View, create, update, and delete all roles, define their permissions, and assign roles to users, groups, API keys, and other resources.	permit (principal, action, resource is Cloudinary::Role); permit (principal, action, resource == Cloudinary::Feature::"cld::global::roles_permissions::manage");
cld::policy::global::billing::view	View Billing	View plan details, add-on subscriptions, and current usage and billing information.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::billing::view");
cld::policy::global::billing::manage	Manage Billing	View and manage all billing-related information, including plan details, payment method, and add-on subscriptions. To purchase add-ons for additional users or product environments, this permission must be paired with the 'View users and groups' and 'View a product environment' permissions, respectively.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::billing::view"); permit (principal, action, resource == Cloudinary::Feature::"cld::global::billing::update");
cld::policy::global::account_review::challenge	Request prohibited content review	Request a review when an account has been flagged for prohibited content.	permit (principal, action, resource is Cloudinary::AccountReview);
cld::policy::global::idp_oauth_clients::view	View OAuth clients	View the OAuth clients configured for the account, including their client IDs and details.	permit(principal, action == IDP::Action::"read", resource is IDP::OauthClient); permit(principal, action, resource == Cloudinary::Feature::"cld::global::idp_oauth_clients::view");
cld::policy::global::idp_oauth_clients::manage	Manage OAuth clients	Create, view, update, delete, and regenerate secrets for the OAuth clients configured for the account.	permit(principal, action, resource is IDP::OauthClient); permit(principal, action, resource == Cloudinary::Feature::"cld::global::idp_oauth_clients::view"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::idp_oauth_clients::manage");

Product environment settings

You can assign the permissions in this section to users and groups through roles.

• You can assign 'View API keys' and 'Manage API keys' permissions to account-level API keys.

• You can assign other permissions listed below, if available programmatically, to product environment API keys.

The table below describes each permission and what it allows:

Policy ID	Name	Description	Policy Statement
cld::policy::global::api_keys::view	View API keys	View the product environment API keys. Each key includes an API key and secret pair.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::APIKey); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::view");
cld::policy::global::api_keys::manage	Manage API keys	Manage the product environment API keys. Each key includes an API key and secret pair.	permit(principal, action, resource is Cloudinary::APIKey); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::view"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::create"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::update"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::delete");
cld::policy::global::upload_presets::manage	Manage upload settings	View, create, modify, or delete upload settings, such as upload presets, upload mappings, and upload defaults.	permit(principal, action, resource is Cloudinary::UploadPreset); permit(principal, action, resource is Cloudinary::UploadMapping); permit(principal, action == Cloudinary::Action::"update_settings", resource is Cloudinary::ProductEnvironment); permit(principal, action, resource == Cloudinary::Feature::"cld::global::upload_settings::manage"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::upload_settings::access");
cld::policy::global::backup_settings::manage	Manage backup settings	Manage backup settings, including selecting a backup location and enabling or disabling backup for newly uploaded assets.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::backup_settings::manage"); permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::ProductEnvironment); permit(principal, action == Cloudinary::Action::"update_settings", resource is Cloudinary::ProductEnvironment);
cld::policy::global::initiate_backup_settings::manage	Back up existing assets	Initiate a backup for all existing assets.	permit(principal, action == Cloudinary::Action::"initiate_backup", resource is Cloudinary::ProductEnvironment);
cld::policy::global::assets::bulk_delete_assets	Access bulk delete settings	Delete assets in bulk based on filter criteria from the Bulk Delete page in Console Settings.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::bulk_delete_assets::manage"); permit(principal, action == Cloudinary::Action::"bulk_delete_assets", resource is Cloudinary::ProductEnvironment);
cld::policy::global::optimization_settings::manage	Manage optimization settings	Define optimization settings such as image and video quality, and handling of CMYK in derived images.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::optimization_settings::manage"); permit(principal, action == Cloudinary::Action::"update_settings", resource is Cloudinary::ProductEnvironment);
cld::policy::global::delivery_settings::manage	Manage delivery settings	Define access control list (ACL) conditions and rules in the Console to control who can access assets, and manage Media Optimizer delivery sources.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::delivery_settings::manage"); permit(principal, action == Cloudinary::Action::"update_settings", resource is Cloudinary::ProductEnvironment); permit(principal, action, resource is Cloudinary::MediaSources);
cld::policy::global::webhook_notifications::view	View webhook notifications	View webhook notification URLs the event types sent to each one.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::view"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Trigger);
cld::policy::global::webhook_notifications::manage	Manage webhook notifications	View, create, and delete webhook notification URLs, and manage the event types sent to each one.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::view"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::create"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::update"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::delete"); permit(principal, action, resource is Cloudinary::Trigger);
cld::policy::global::prodenv_security::manage	Manage product environment security settings	Configure security settings that control how the assets in your product environment can be delivered.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::prodenv_security::manage"); permit(principal, action == Cloudinary::Action::"update_settings", resource is Cloudinary::ProductEnvironment);
cld::policy::global::agents::manage	Manage agent settings	View and manage all agent settings.	permit(principal, action == Cloudinary::Action::"update_agent_settings", resource is Cloudinary::ProductEnvironment);

Dashboard and reports

You can assign the permissions in this section to groups and users through roles.

Policy ID	Name	Description	Policy Statement
cld::policy::global::ml_dashboard::access	Access the Assets Dashboard	View the Assets Dashboard, including usage summaries and trend graphs. Access is limited to data the user is permitted to see.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::ml_dashboard::access");
cld::policy::global::reports::delivery::view	View Delivery Reports	View detailed media delivery analytics, such as bandwidth and request usage, top-performing assets and transformations, referral domains, and formats.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::reports::delivery::view"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Report) when {resource.type == "delivery"};
cld::policy::global::reports::errors::view	View Error Reports	View delivery error trends, including any errors generated from API calls or delivery URL requests.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::reports::errors::view"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Report) when {resource.type == "error"};
cld::policy::global::reports::monthly::view	View Monthly Value Reports	View metrics that highlight Cloudinary’s added value, such as bandwidth savings and time saved through automation.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::reports::monthly::view"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Report) when {resource.type == "monthly_report"};
cld::policy::global::reports::auto_monthly::view	Access Monthly Usage Reports	Enable or disable email delivery of the 'Monthly Usage Report' from email preferences in the Console.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::reports::auto_monthly::view"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::Report) when { resource.type == "auto_monthly_report" };
cld::policy::global::reports::usage::view	Access Usage Reports	View the Usage Reports for the product environment, including usage summaries and trend graphs for transformations, storage, bandwidth, impressions, and delivered video seconds.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::reports::usage::view"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::Report) when { resource.type == "env_usage" };
cld::policy::global::assets_reports::access	Access Assets Report	View Assets Reports, including monthly analytics on Media Library engagement, search behavior, downloads, and collection activity. Access is limited to data the user is permitted to see.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::assets_reports::access"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Report) when {resource.type == "assets_reports"};

Cloudinary Image

You can assign the permissions in this section to users and groups through roles. You can also assign these permissions to product environment API keys for actions that are available programmatically.

Policy ID	Name	Description	Policy Statement
cld::policy::global::image::access	Access Cloudinary Image	Access Cloudinary Image in the Console and use Studio for single and bulk transformations, including within the Media Library.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::image::access"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::ProductEnvironment);
cld::policy::global::unnamed_transformations::view	View unnamed transformations	View unnamed transformations that were applied to assets.	permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::Transformation) when { resource.named == false }; permit (principal, action, resource == Cloudinary::Feature::"cld::global::unnamed_transformations::view");
cld::policy::global::unnamed_transformations::manage	Manage unnamed transformations	Manage unnamed transformations, including deleting them and configuring whether they can be used when Strict Transformations are enabled.	permit(principal, action, resource is Cloudinary::Transformation) when {resource.named == false}; permit (principal, action, resource == Cloudinary::Feature::"cld::global::unnamed_transformations::manage");
cld::policy::global::named_transformations::view	View all named transformations	View all named transformations and the individual transformations they include.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Transformation) when { resource.named == true}; permit(principal, action, resource == Cloudinary::Feature::"cld::global::named_transformations::view");
cld::policy::global::named_transformations::delete	Delete all named transformations	Delete all existing named transformations.	permit (principal, action == Cloudinary::Action::"delete", resource is Cloudinary::Transformation) when { resource.named == true }; permit (principal, action, resource == Cloudinary::Feature::"cld::global::named_transformations::delete");
cld::policy::global::named_transformations::update	Update all named transformations	Update existing named transformations	permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::Transformation) when {resource.named == true}; permit(principal, action, resource == Cloudinary::Feature::"cld::global::named_transformations::update");
cld::policy::global::named_transformations::create	Create named transformations	Create new named transformations.	permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::Transformation) when {resource.named == true}; permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Transformation) when {resource.named == true}; permit(principal, action, resource == Cloudinary::Feature::"cld::global::named_transformations::create");

Cloudinary Video

You can assign the permissions in this section to users and groups through roles. You can also assign these permissions to product environment API keys for actions that are available programmatically.

Policy ID	Name	Description	Policy Statement
cld::policy::global::video::access	Access Cloudinary Video	Access Cloudinary Video in the Console, including tools for managing video assets, customizing video players, and previewing transformed video content.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::video::access"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::ProductEnvironment);
cld::policy::global::video:video_analytics::view	View Video Analytics	View Video Player performance metrics in the Video Analytics page, including plays, watch time, unique viewers, and top-performing videos.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::video_analytics::view"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::VideoAnalyticsView);
cld::policy::global::video:live_streams::manage	Manage live streams	Create, update, and delete live stream entries, configure stream settings, and access live stream details.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::live_streams::manage"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::LiveStream); permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::LiveStream); permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::LiveStream); permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::LiveStream);
cld::policy::global::video_player_profiles::manage	Manage Video Player profiles	Create, edit, and apply video player profiles to control player appearance and behavior, with access to the Video Player Studio for visual customization.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::video_player_profiles::manage"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::VideoPlayerProfile); permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::VideoPlayerProfile); permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::VideoPlayerProfile); permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::VideoPlayerProfile);
cld::policy::global::video_player_config::manage	Manage Video Player configuration	Create, edit, and apply video player configuration to control player appearance and behavior, with access to the Video Player Studio for visual customization.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::video_player_config::manage"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::VideoPlayerConfig); permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::VideoPlayerConfig); permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::VideoPlayerConfig); permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::VideoPlayerConfig);

Management via Assets and APIs

You can assign the permissions in this section to users and groups through roles. You can also assign these permissions to product environment API keys for actions that are available programmatically.

Policy ID	Name	Description	Policy Statement
cld::policy::global::structured_metadata::access	Manage structured metadata fields	Create and manage structured metadata fields, define conditional rules, and configure datasources (list values) for single and multi-selection fields.	permit(principal, action, resource is Cloudinary::MetadataField); permit(principal, action, resource == Cloudinary::Feature::"cld::global::structured_metadata::access");
cld::policy::global::add_ons::run	Use add-ons	Apply functionality from add-ons that are enabled for the account. Note that usage may consume quota based on the add-on plan.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::add_ons::run");
cld::policy::global::folder_and_asset_management::delete	Delete all folders and assets	Delete all folders and assets without requiring specific folder permissions.	permit(principal, action in [Cloudinary::Action::"delete"], resource is Cloudinary::Asset); permit(principal, action in [Cloudinary::Action::"delete"], resource is Cloudinary::Folder);
cld::policy::global::folder_and_asset_management::view	View all folders and assets	View all folders and assets without requiring specific folder asset permissions. Downloading requires a separate permission.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Asset); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Folder); permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::MetadataField) when { resource has allow_dynamic_list_values && resource.allow_dynamic_list_values == true };
cld::policy::global::folder_and_asset_management::public::download	Download all folders and their public assets	Download all folders and their assets with access control set to 'Public'. The download is a ZIP file, and the root folder can't be downloaded.	permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Asset) when { !["authenticated", "private"].contains(resource.type) && !resource.has_access_control}; permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Folder);
cld::policy::global::folder_and_asset_management::restricted::download	Download all folders and their restricted assets	Download all folders and their assets with access control set to 'Restricted'. The download is a ZIP file, and the root folder can't be downloaded.	permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Asset) when { (["authenticated", "private"].contains(resource.type)) \
cld::policy::global::folder_and_asset_management::create_folder	Create folders in all locations	Create folders anywhere within the folder hierarchy without requiring specific folder permissions.	permit(principal, action in [Cloudinary::Action::"create", Cloudinary::Action::"read"], resource is Cloudinary::Folder);
cld::policy::global::folder_and_asset_management::create_asset	Upload assets	Upload assets to any folder, including the root, without requiring specific folder permissions. Includes the option to select an upload preset and apply tags and metadata.	permit(principal, action in [Cloudinary::Action::"create"], resource is Cloudinary::Asset); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::UploadPreset);
cld::policy::global::folder_and_asset_management::update	Update all folders and assets	Move, rename, and overwrite all folders and assets without requiring specific folder permissions.	permit(principal, action in [Cloudinary::Action::"update"], resource is Cloudinary::Asset); permit(principal, action in [Cloudinary::Action::"update"], resource is Cloudinary::Folder); permit(principal, action in [Cloudinary::Action::"rename"], resource is Cloudinary::Asset); permit(principal, action in [Cloudinary::Action::"rename"], resource is Cloudinary::Folder); permit(principal, action in [Cloudinary::Action::"move"], resource is Cloudinary::Folder); permit(principal, action in [Cloudinary::Action::"move"], resource is Cloudinary::Asset);
cld::policy::global::folder_and_asset_management::update_access_control	Update access control for all assets	Change access control settings for all assets between 'Public' and 'Restricted' without requiring specific folder permissions.	permit(principal, action == Cloudinary::Action::"update_access_control", resource is Cloudinary::Asset);
cld::policy::global::restore	Restore deleted assets	Restore all deleted assets.	permit(principal, action == Cloudinary::Action::"restore", resource is Cloudinary::Asset); permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::Folder); permit(principal, action, resource == Cloudinary::Feature::"cld::global::assets::restore");
cld::policy::global::folders::share	Share all folders	Share all folders within the folder hierarchy without requiring specific folder permissions.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::folders::share"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Role); permit(principal, action == Cloudinary::Action::"invite", resource is Cloudinary::Folder);
cld::policy::global::people::view	View people	View the people detected by People Search, and the images associated with each person.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Person);
cld::policy::global::people::manage	Manage people	View and manage the people detected by People Search, including naming people, hiding or showing them in the gallery, and setting each person's cover image.	permit(principal, action, resource is Cloudinary::Person);
cld::policy::global::bulk_operations::manage	Manage bulk operations	Ability to create, view, cancel, pause, resume, and approve bulk operations on assets	permit (principal, action, resource is Cloudinary::BulkOperation);

Management via Assets

You can assign the permissions in this section to users and groups through roles.

Policy ID	Name	Description	Policy Statement
cld::policy::global::portals::view	Access portals	Manage all portals with full create, read, update, and delete access. The 'View collection' permission is required to add a specific collection to a portal.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::portals::access");
cld::policy::global::basic_portals::access	Manage basic portals	Manage all basic portals with full create, read, update, and delete permissions.	permit(principal, action, resource is Cloudinary::Portal); permit(principal, action == Cloudinary::Action::"read", resource == Cloudinary::Feature::"cld::global::basic_portals::access"); permit(principal, action, resource is Cloudinary::PublicLink) when { resource.subject_type == "portal"};
cld::policy::global::ml_preferences::manage	Set Media Library Preferences	Control the way the Media Library looks and behaves for all users in the product environment.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::ml_preferences::access"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::ml_preferences::update");
cld::policy::global::activity_reports::access	View and generate activity reports	View and generate reports that list all account management activities and product environment actions.	permit (principal, action, resource is Cloudinary::Report) when {resource.type=="audit_log"}; permit (principal, action, resource == Cloudinary::Feature::"cld::global::activity_reports::access");
cld::policy::global::moderation_queue::access	Access the Moderation page	Access the Moderation page. To view assets on this page, pair this permission with the 'View assets' folder permission, or 'View all folders and assets' global permission. To also approve or reject assets, pair it with 'Moderate assets' folder permission or 'Moderate all assets' global permission.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::moderation_queue::access");
cld::policy::global::ml::access	Access the Media Library	Access the Media Library within the Console. Without this permission, users can't view any assets.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::ml::access"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::MetadataField); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::ProductEnvironment);
cld::policy::global::marketplace:manage	Manage the Assets App Marketplace	Manage the App Marketplace by enabling or disabling apps that extend DAM functionality based on company needs.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::app_marketplace::access"); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::DamApp); permit(principal, action == Cloudinary::Action::"subscribe", resource is Cloudinary::DamApp); permit(principal, action == Cloudinary::Action::"unsubscribe", resource is Cloudinary::DamApp);
cld::policy::global::marketplace:read	Use DAM Apps	Access and use DAM apps that have been enabled from the Assets App Marketplace, directly within the Media Library.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::DamApp);
cld::policy::global::smd:bulk_upload	Bulk update structured metadata via CSV	Upload a CSV file to bulk update structured metadata fields across multiple assets.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::update_smd_by_csv::access"); permit(principal, action in [Cloudinary::Action::"create", Cloudinary::Action::"read"], resource is Cloudinary::Folder) when { resource.path like "cld_system_files*"};
cld::policy::global::delivery_url::access	Access delivery URLs via the Console	Access delivery URLs of original and transformed assets, including the ability to view, copy, and open them in a new tab. Access is limited to assets the user is permitted to view.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::delivery_url::access");
cld::policy::global::creative_approval::approval_flows::manage	Manage approval flows	View, create, configure, update, and delete approval flows, and assign reviewers.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::creative_approval::approval_flows::manage"); permit (principal, action, resource is CreativeApproval::Reviewer); permit (principal, action, resource is CreativeApproval::ApprovalFlow);
cld::policy::global::creative_approval::approval_flows::view	View approval flows	View all approval flows, which are required in order to create proofs.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::creative_approval::approval_flows::view"); permit (principal, action == CreativeApproval::Action::"read", resource is CreativeApproval::ApprovalFlow); permit (principal, action == CreativeApproval::Action::"list", resource is CreativeApproval::ApprovalFlow);
cld::policy::global::creative_approval::proofs::manage	Manage proofs	Create, view, list, and delete all proofs. Pair this with 'Manage approval flows' for administrators, or assign it on its own to users who need full control over proofs.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::creative_approval::proofs::manage"); permit (principal, action, resource is CreativeApproval::Proof);
cld::policy::global::creative_approval::proofs::view	View proofs	View all proofs containing assets the user has permission to view, either via the 'View assets' folder permission or the 'View all folders and assets' global permission.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::creative_approval::proofs::view"); permit (principal, action == CreativeApproval::Action::"read", resource is CreativeApproval::Proof); permit (principal, action == CreativeApproval::Action::"list", resource is CreativeApproval::Proof);
cld::policy::global::rights_management_by_fadel::access	Check clearance using FADEL	Use the FADEL integration to check rights clearance for assets the user has permission to view, either via the 'View assets' folder permission or the 'View all folders and assets' global permission.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::rights_management_by_fadel::access");
cld::policy::global::assets::moderate	Moderate all assets	Approve and reject all assets in moderation. To perform these actions from the Moderation page, pair this permission with 'Access the Moderation page'. To view the assets on the page, pair it with the 'View all folders and assets' global permission.	permit(principal, action == Cloudinary::Action::"moderate", resource is Cloudinary::Asset);
cld::policy::global::public_links::manage	Manage public links	Create, view, update, and delete public links to share collections externally. Also allows sharing assets directly, provided the user has view access through either the 'View assets' folder permission or the 'View all folders and assets' global permission.	permit (principal, action, resource is Cloudinary::PublicLink) when { resource.subject_type == "asset" }; permit (principal, action, resource is Cloudinary::PublicLink) when { resource.subject_type == "collection" }; permit (principal, action, resource is Cloudinary::PublicLink) when { resource.subject_type == "portal" };
cld::policy::global::collections::create	Create (non-dynamic) collections	Create non-dynamic collections.	permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::Collection);
cld::policy::global::collections::view	View all (non-dynamic) collections	View all non-dynamic collections and the assets inside them without requiring folder permissions.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Collection);
cld::policy::global::collections::update	Manage all (non-dynamic) collections	Manage all non-dynamic collections. Includes renaming collections and adding or removing assets the user view can via the 'View assets' collection permission or the 'View all folders and assets' global permission.	permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::Collection); permit(principal, action == Cloudinary::Action::"add_asset", resource is Cloudinary::Collection); permit(principal, action == Cloudinary::Action::"remove_asset", resource is Cloudinary::Collection); permit(principal, action == Cloudinary::Action::"create",resource is Cloudinary::PublicLink) when {resource.subject_type=="collection"}; permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Collection); permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::Collection);
cld::policy::global::collections::invite	Invite to all (non-dynamic) collections	Invite other users to access all non-dynamic collections and assign them different permission levels.	permit(principal, action == Cloudinary::Action::"invite", resource is Cloudinary::Collection);
cld::policy::global::dynamic_collections::manage	Manage all dynamic collections	Create, update, publicly share, and delete dynamic collections, as well as view all assets included in them.	permit(principal, action, resource is Cloudinary::DynamicCollection); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Asset); permit (principal,action == Cloudinary::Action::"create", resource is Cloudinary::PublicLink) when {resource.subject_type=="collection"};
cld::policy::global::specialized_tools_in_assets::access	Access specialized tools in Assets	Access Studio, Advanced Editing, Video Canvas, Image to Video, and Video Player Studio from the Media Library. Additional permissions are required to perform actions within these tools.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::specialized_tools_in_assets::access");

Other Cloudinary products

You can assign the permissions in this section to users and groups through roles. You can also assign these permissions to product environment API keys for actions that are available programmatically.

Policy ID	Name	Description	Policy Statement
cld::policy::global::media_flows::build	Build workflow automations	Create, update, and delete EasyFlows and PowerFlows.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::media_flows::access"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::automation::access"); permit(principal, action == MediaFlows::Action::"create", resource is MediaFlows::EasyFlow); permit(principal, action == MediaFlows::Action::"create", resource is MediaFlows::PowerFlow); permit(principal, action == MediaFlows::Action::"update", resource is MediaFlows::EasyFlow); permit(principal, action == MediaFlows::Action::"update", resource is MediaFlows::PowerFlow); permit(principal, action == MediaFlows::Action::"delete", resource is MediaFlows::EasyFlow); permit(principal, action == MediaFlows::Action::"delete", resource is MediaFlows::PowerFlow); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::EasyFlow); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::PowerFlow); permit(principal, action == MediaFlows::Action::"read_details", resource is MediaFlows::LogEntry); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::LogEntry); permit(principal, action == MediaFlows::Action::"execute", resource is MediaFlows::EasyFlow); permit(principal, action == MediaFlows::Action::"execute", resource is MediaFlows::PowerFlow); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::Automation); permit(principal, action == MediaFlows::Action::"execute", resource is MediaFlows::Automation); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::view"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::create"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::update"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::api_keys::delete"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::view"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::create"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::update"); permit(principal, action, resource == Cloudinary::Feature::"cld::global::webhook_notifications::delete"); permit(principal, action, resource is Cloudinary::Trigger);
cld::policy::global::media_flows::connection	Manage apps & connections	Create, configure, and delete connections used by MediaFlows flows.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::media_flows::access"); permit(principal, action == MediaFlows::Action::"create", resource is MediaFlows::Connection); permit(principal, action == MediaFlows::Action::"update", resource is MediaFlows::Connection); permit(principal, action == MediaFlows::Action::"delete", resource is MediaFlows::Connection); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::Connection);
cld::policy::global::media_flows::notification	Handle notifications	Receive MediaFlows notifications.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::media_flows::access"); permit(principal, action == MediaFlows::Action::"update", resource is MediaFlows::Notification); permit(principal, action == MediaFlows::Action::"delete", resource is MediaFlows::Notification); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::Notification);
cld::policy::global::media_flows::execute_from_assets	Execute flows from Assets	Execute existing EasyFlows and PowerFlows from the Assets view.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::automation::access"); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::Automation); permit(principal, action == MediaFlows::Action::"execute", resource is MediaFlows::Automation);
cld::policy::global::media_flows::usage_n_plane::view	View MediaFlows usage and plan details	View current MediaFlows plan details, credit usage, and usage breakdowns across all product environments.	permit(principal, action, resource == Cloudinary::Feature::"cld::global::media_flows::access"); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::Usage); permit(principal, action == MediaFlows::Action::"read", resource is MediaFlows::Plan);
cld::policy::global::cloudinary_moderation::access	Access Cloudinary Moderation	Access Cloudinary Moderation in the Console to define moderation rules, run AI checks on images and videos against your brand, quality, and compliance guidelines, and review or override the results.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::cloudinary_moderation::access"); permit (principal, action == Cloudinary::Action::"read", resource is Cloudinary::ProductEnvironment);
cld::policy::global::agents::taxonomy::invoke	Use the Taxonomy Agent	Use the Taxonomy Agent to create, improve, and maintain metadata and taxonomy at scale. The agent can only view content and perform actions permitted to the user.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::agent::invoke"); permit (principal, action == Cloudinary::Action::"invoke", resource == Cloudinary::Agent::"taxonomy");
cld::policy::global::agents::search::invoke	Use the Search Agent	Use the Search Agent to find assets with natural-language search. The agent can only view content and perform actions permitted to the user.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::agent::invoke"); permit (principal, action == Cloudinary::Action::"invoke", resource == Cloudinary::Agent::"search");
cld::policy::global::agents::workflow::invoke	Use the Workflow Agent	Use the Workflow Agent to create and manage automated MediaFlows using natural-language instructions. The agent can only view content and perform actions permitted to the user.	permit (principal, action, resource == Cloudinary::Feature::"cld::global::agent::invoke"); permit (principal, action == Cloudinary::Action::"invoke", resource == Cloudinary::Agent::"workflow");

Folder permissions

You can assign the permissions in this section to users, groups, or product environment API keys through folder roles.

Policy ID	Name	Description	Policy Statement
cld::policy::content::folder::view_download	View assets	View all assets in the folder and its nested subfolders.	permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("") }; permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") };
cld::policy::content::folder::download_public_assets	Download public assets	Download all assets marked as 'Public' in the folder and its subfolders.	permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")}; permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") && !["authenticated", "private"].contains(resource.type) && !resource.has_access_control};
cld::policy::content::folder::download_restricted_assets	Download restricted assets	Download all assets marked as 'Restricted' in the folder and its subfolders.	permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")}; permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") && ( ["authenticated", "private"].contains(resource.type) \
cld::policy::content::folder::add_assets	Add assets	Add assets to the folder by uploading new files, saving an asset as new, or moving existing assets from other folders. Tags and structured metadata can be applied during upload.	permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("")}; permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "in"}; permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::UploadPreset);
cld::policy::content::folder::create_subfolders	Create subfolders	Create subfolders or move existing folders into this folder.	permit(principal, action == Cloudinary::Action::"create", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::update_assets	Edit assets and metadata	Perform actions on assets in the folder and its subfolders, including replacing, editing, and relating assets, restoring versions, and updating tags, structured metadata, and contextual metadata.	permit(principal, action == Cloudinary::Action::"update", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::rename_subfolders	Rename subfolders	Rename subfolders within the folder. This doesn't include permission to rename the folder itself.	permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Folder) when { resource != Cloudinary::Folder::"" && resource.ancestor_ids.contains("")};
cld::policy::content::folder::rename_assets	Rename assets	Edit the display names and public IDs of assets in the folder and its subfolders. In the legacy fixed-folder mode, renaming a public ID also requires the ‘Move assets’ permission.	permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::delete_assets	Delete assets	Delete assets in the folder and its subfolders.	permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::delete_subfolders	Delete subfolders	Delete subfolders within the folder. To delete subfolders that contain assets, the user must also have the 'Delete assets' permission for those subfolders.	permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::Folder) when { resource != Cloudinary::Folder::"" && resource.ancestor_ids.contains("")};
cld::policy::content::folder::move_assets	Move assets	Move assets between folders. This action also requires the 'Add assets' permission for the destination folder.	permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "out"}; permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "in"}; permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") };
cld::policy::content::folder::delete	Delete folder	Delete the folder and its contents. If the folder contains assets, the user must also have the 'Delete assets' permission for the folder. This action is limited to folders with 1,000 assets or fewer.	permit(principal, action == Cloudinary::Action::"delete", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::rename	Rename folder	Rename the folder and its subfolders. This action isn't available in fixed folder mode.	permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")}; permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") };
cld::policy::content::folder::move	Move folder	Move the folder and all of its contents to a different location in the folder hierarchy. For example, move Folder A (and its subfolder B) into a new parent folder. In fixed folder mode, this action also requires the 'Move assets' permission for the folder.	permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "out"}; permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "in"}; permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::move_subfolders	Move subfolders	Move subfolders to a different location in the folder hierarchy. For example, move Folder C out of Folder B, without moving Folder B itself. In fixed folder mode, this action also requires the 'Move assets' permission for the subfolder.	permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "out"}; permit(principal, action == Cloudinary::Action::"move", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("") && context has direction && context.direction == "in"}; permit(principal, action == Cloudinary::Action::"rename", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")};
cld::policy::content::folder::moderate	Moderate assets	Approve or reject assets in the folder and its subfolders, and view the Moderation page.	permit(principal, action == Cloudinary::Action::"moderate", resource is Cloudinary::Asset) when {resource.ancestor_ids.contains("")}; permit (principal, action, resource == Cloudinary::Feature::"cld::global::moderation_queue::access");
cld::policy::content::folder::manage_public_link	Manage public links to assets	Create, view, update, and delete public links for assets in the folder and its subfolders, including setting access date ranges.	permit (principal, action, resource is Cloudinary::PublicLink) when {resource.subject_type=="asset" && resource.subject_ancestor_ids.contains("")};
cld::policy::content::folder::edit_access_control	Edit access control	Set asset access control to 'Public' or 'Restricted' for assets in a folder and its subfolders, with an optional date range for public access.	permit(principal, action == Cloudinary::Action::"update_access_control", resource is Cloudinary::Asset) when { resource.ancestor_ids.contains("") && !["authenticated", "private"].contains(resource.type)};
cld::policy::content::folder::invite	Share with users and groups	Manage user and group access to the folder and its subfolders. Users can only assign and remove permission levels that are equal to or lower than their own for that folder.	permit(principal, action == Cloudinary::Action::"invite", resource is Cloudinary::Folder) when { resource.ancestor_ids.contains("")};

Collection permissions

You can assign the permissions in this section to users and groups through collection roles.

Policy ID	Name	Description	Policy Statement
cld::policy::content::collection::view	View assets	View the collection and all the assets in it without requiring global or folder permissions for those assets.	permit(principal, action == Cloudinary::Action::"read", resource == Cloudinary::Collection::""); permit(principal, action == Cloudinary::Action::"read", resource is Cloudinary::Asset) when { resource has collection_ids && resource.collection_ids.contains("") };
cld::policy::content::collection::download_public_assets	Download public assets	Download all assets marked as 'Public' in the collection without requiring global or folder permissions.	permit(principal, action == Cloudinary::Action::"download", resource == Cloudinary::Collection::""); permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Asset) when { resource has collection_ids && resource.collection_ids.contains("") && !["authenticated", "private"].contains(resource.type) && !resource.has_access_control };
cld::policy::content::collection::download_restricted_assets	Download restricted assets	Download all assets marked as 'Restricted' in the collection without requiring global or folder permissions.	permit(principal, action == Cloudinary::Action::"download", resource == Cloudinary::Collection::""); permit(principal, action == Cloudinary::Action::"download", resource is Cloudinary::Asset) when { resource has collection_ids && resource.collection_ids.contains("") && ( ["authenticated", "private"].contains(resource.type) \
cld::policy::content::collection::add_assets	Add assets	Add assets to the collection. Users can only add assets they are permitted to view via the 'View assets' folder permission or the 'View all folders and assets' global permission.	permit(principal, action == Cloudinary::Action::"add_asset", resource == Cloudinary::Collection::"");
cld::policy::content::collection::remove_assets	Remove assets	Remove assets from the collection. Users can only remove assets they are permitted to view via the 'View assets' folder permission or the 'View all folders and assets' global permission.	permit(principal, action == Cloudinary::Action::"remove_asset", resource == Cloudinary::Collection::"");
cld::policy::content::collection::update	Edit collection details	Rename the collection and edit its description.	permit(principal, action == Cloudinary::Action::"update", resource == Cloudinary::Collection::"");
cld::policy::content::collection::delete	Delete collection	Delete the collection. This action doesn't affect the assets in it.	permit(principal, action == Cloudinary::Action::"delete", resource == Cloudinary::Collection::"");
cld::policy::content::collection::mange_public_link	Manage public link	View, create, copy, update, configure, and delete the public link for the collection, and share public links to individual assets within the collection.	permit (principal, action, resource is Cloudinary::PublicLink) when { resource.subject_type == "collection" && resource.subject_id == "" }; permit (principal, action, resource is Cloudinary::PublicLink) when {resource.subject_type == "asset" && resource has subject_collection_ids && resource.subject_collection_ids.contains("")};
cld::policy::content::collection::invite	Invite users and groups	Invite users and groups to a collection, and add, edit, or remove their permissions. Users can only assign and remove permission levels that are equal to or lower than their own for that collection.	permit(principal, action == Cloudinary::Action::"invite", resource == Cloudinary::Collection::"");

Saved search permissions

You can assign the permission in this section to users or groups through saved search roles.

Policy ID	Name	Description	Policy Statement
cld::policy::saved_search::view::view_saved_search	View saved search	View the saved search, including its filters and the assets it returns. Results only include assets the user can already view, and the search itself can't be edited, renamed, or deleted.	permit(principal, action == Cloudinary::Action::"read", resource == Cloudinary::SavedSearch::"");

System roles list

This section lists all system roles, including each role's ID, name, description. Below each group of roles, you'll see the policy IDs for all the policies it includes.

You can use this list to:

• Decide which role to assign to a user, group, or API key.

• Look up the role ID when assigning the role.

• Review the system policies granted by roles that are already in use.

For more background information about system policies, see Role-based permissions overview.

For more information on system roles, see Manage roles.

Global roles

Account-level roles

You can assign the permissions in this section to groups and users through roles. You can also assign these roles to API keys for actions that are available programmatically.

Role ID	Role Name	Description	Policy IDs
cld::role::account::master_admin	Master Admin	Manage all account-level settings and features.	20 policies (see list below)
cld::role::account::admin	Admin	Manage roles, add-ons, users, and groups, and view monthly value reports.	8 policies (see list below)
cld::role::account::billing	Billing	Manage account-level billing, usage reports, add-ons, and upgrades.	7 policies (see list below)
cld::role::account::reports	Reports	Access account-level reporting details.	3 policies (see list below)
cld::role::account::tech_admin	Tech Admin	Manage add-ons and view monthly value reports.	4 policies (see list below)
cld::role::account::mediaflows_admin	MediaFlows Admin	Manage MediaFlows plan and usage details, plus add-ons, account information, account management keys, and product environments.	7 policies (see list below)

Master Admin - Full policy list

• cld::policy::global::add_ons::run

• cld::policy::global::account_information::manage

• cld::policy::global::account_review::challenge

• cld::policy::global::account_api_keys::manage

• cld::policy::global::product_environments::list

• cld::policy::global::product_environments::create

• cld::policy::global::product_environments::delete

• cld::policy::global::users_and_groups::view

• cld::policy::global::users_and_groups::manage

• cld::policy::global::account_security::view

• cld::policy::global::account_security::manage

• cld::policy::global::roles_permissions::manage

• cld::policy::global::idp_oauth_clients::view

• cld::policy::global::idp_oauth_clients::manage

• cld::policy::global::billing::view

• cld::policy::global::billing::manage

• cld::policy::global::reports::monthly::view

• cld::policy::global::reports::auto_monthly::view

• cld::policy::global::media_flows::usage_n_plane::view

• cld::policy::global::activity_reports::access

Admin - Full policy list

• cld::policy::global::add_ons::run

• cld::policy::global::users_and_groups::view

• cld::policy::global::users_and_groups::manage

• cld::policy::global::roles_permissions::manage

• cld::policy::global::idp_oauth_clients::view

• cld::policy::global::idp_oauth_clients::manage

• cld::policy::global::reports::monthly::view

• cld::policy::global::media_flows::usage_n_plane::view

Billing - Full policy list

• cld::policy::global::product_environments::list

• cld::policy::global::product_environments::create

• cld::policy::global::product_environments::delete

• cld::policy::global::users_and_groups::view

• cld::policy::global::billing::view

• cld::policy::global::billing::manage

• cld::policy::global::media_flows::usage_n_plane::view

Reports - Full policy list

• cld::policy::global::reports::monthly::view

• cld::policy::global::reports::auto_monthly::view

• cld::policy::global::media_flows::usage_n_plane::view

Tech Admin - Full policy list

• cld::policy::global::add_ons::run

• cld::policy::global::idp_oauth_clients::view

• cld::policy::global::idp_oauth_clients::manage

• cld::policy::global::reports::monthly::view

MediaFlows Admin - Full policy list

• cld::policy::global::add_ons::run

• cld::policy::global::account_information::manage

• cld::policy::global::account_api_keys::manage

• cld::policy::global::product_environments::list

• cld::policy::global::idp_oauth_clients::view

• cld::policy::global::idp_oauth_clients::manage

• cld::policy::global::media_flows::usage_n_plane::view

Product environment-level roles

You can assign the permissions in this section to users and groups through roles.

• You can assign 'View API keys' and 'Manage API keys' permissions to account-level API keys.

• You can assign other permissions listed below, if available programmatically, to product environment API keys.

Role ID	Role Name	Description	Policy IDs
cld::role::prodenv::master_admin	Master Admin	Fully manage product environment, including settings, product features, dashboards, and reports.	73 policies (see list below)
cld::role::prodenv::admin	Admin	Manage product environment, including Console Settings, product features, and relevant dashboards and reports.	69 policies (see list below)
cld::role::prodenv::tech_admin	Tech Admin	Manage product environment, including Console Settings, key product features (except MediaFlows), and relevant dashboards and reports.	66 policies (see list below)
cld::role::prodenv::ml_admin	Media Library Admin	Full Media Library access, plus Transformations, Creative Approval, and App Marketplace. Excludes structured metadata management.	47 policies (see list below)
cld::role::prodenv::ml_user	Media Library User	Access specific folders and collections according to assigned permissions.	7 policies (see list below)
cld::role::prodenv::reports	Reports	Access product environment reporting details only.	9 policies (see list below)

Master Admin - Full policy list

• cld::policy::global::basic_portals::access

• cld::policy::global::ml_preferences::manage

• cld::policy::global::ml_dashboard::access

• cld::policy::global::specialized_tools_in_assets::access

• cld::policy::global::assets_reports::access

• cld::policy::global::structured_metadata::access

• cld::policy::global::moderation_queue::access

• cld::policy::global::ml::access

• cld::policy::global::marketplace:manage

• cld::policy::global::marketplace:read

• cld::policy::global::smd:bulk_upload

• cld::policy::global::delivery_url::access

• cld::policy::global::portals::view

• cld::policy::global::rights_management_by_fadel::access

• cld::policy::global::creative_approval::approval_flows::manage

• cld::policy::global::creative_approval::proofs::manage

• cld::policy::global::assets::moderate

• cld::policy::global::folder_and_asset_management::delete

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::folder_and_asset_management::public::download

• cld::policy::global::folder_and_asset_management::restricted::download

• cld::policy::global::folder_and_asset_management::create_folder

• cld::policy::global::folder_and_asset_management::create_asset

• cld::policy::global::folder_and_asset_management::update

• cld::policy::global::folder_and_asset_management::update_access_control

• cld::policy::global::restore

• cld::policy::global::public_links::manage

• cld::policy::global::folders::share

• cld::policy::global::collections::create

• cld::policy::global::collections::view

• cld::policy::global::collections::update

• cld::policy::global::collections::invite

• cld::policy::global::dynamic_collections::manage

• cld::policy::global::people::view

• cld::policy::global::people::manage

• cld::policy::global::api_keys::view

• cld::policy::global::api_keys::manage

• cld::policy::global::upload_presets::manage

• cld::policy::global::backup_settings::manage

• cld::policy::global::initiate_backup_settings::manage

• cld::policy::global::assets::bulk_delete_assets

• cld::policy::global::bulk_operations::manage

• cld::policy::global::optimization_settings::manage

• cld::policy::global::delivery_settings::manage

• cld::policy::global::webhook_notifications::view

• cld::policy::global::webhook_notifications::manage

• cld::policy::global::prodenv_security::manage

• cld::policy::global::agents::manage

• cld::policy::global::product_environments::view

• cld::policy::global::product_environments::update

• cld::policy::global::reports::delivery::view

• cld::policy::global::reports::errors::view

• cld::policy::global::reports::usage::view

• cld::policy::global::image::access

• cld::policy::global::unnamed_transformations::view

• cld::policy::global::unnamed_transformations::manage

• cld::policy::global::named_transformations::view

• cld::policy::global::named_transformations::delete

• cld::policy::global::named_transformations::update

• cld::policy::global::named_transformations::create

• cld::policy::global::video::access

• cld::policy::global::video:video_analytics::view

• cld::policy::global::video:live_streams::manage

• cld::policy::global::video_player_profiles::manage

• cld::policy::global::video_player_config::manage

• cld::policy::global::media_flows::build

• cld::policy::global::media_flows::connection

• cld::policy::global::media_flows::notification

• cld::policy::global::media_flows::execute_from_assets

• cld::policy::global::cloudinary_moderation::access

• cld::policy::global::agents::taxonomy::invoke

• cld::policy::global::agents::search::invoke

• cld::policy::global::agents::workflow::invoke

Admin - Full policy list

• cld::policy::global::basic_portals::access

• cld::policy::global::specialized_tools_in_assets::access

• cld::policy::global::structured_metadata::access

• cld::policy::global::moderation_queue::access

• cld::policy::global::ml::access

• cld::policy::global::marketplace:manage

• cld::policy::global::marketplace:read

• cld::policy::global::smd:bulk_upload

• cld::policy::global::delivery_url::access

• cld::policy::global::portals::view

• cld::policy::global::rights_management_by_fadel::access

• cld::policy::global::creative_approval::approval_flows::view

• cld::policy::global::creative_approval::proofs::manage

• cld::policy::global::assets::moderate

• cld::policy::global::folder_and_asset_management::delete

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::folder_and_asset_management::public::download

• cld::policy::global::folder_and_asset_management::restricted::download

• cld::policy::global::folder_and_asset_management::create_folder

• cld::policy::global::folder_and_asset_management::create_asset

• cld::policy::global::folder_and_asset_management::update

• cld::policy::global::folder_and_asset_management::update_access_control

• cld::policy::global::restore

• cld::policy::global::public_links::manage

• cld::policy::global::folders::share

• cld::policy::global::collections::create

• cld::policy::global::collections::view

• cld::policy::global::collections::update

• cld::policy::global::collections::invite

• cld::policy::global::dynamic_collections::manage

• cld::policy::global::people::view

• cld::policy::global::people::manage

• cld::policy::global::api_keys::view

• cld::policy::global::api_keys::manage

• cld::policy::global::upload_presets::manage

• cld::policy::global::backup_settings::manage

• cld::policy::global::initiate_backup_settings::manage

• cld::policy::global::assets::bulk_delete_assets

• cld::policy::global::optimization_settings::manage

• cld::policy::global::delivery_settings::manage

• cld::policy::global::webhook_notifications::view

• cld::policy::global::webhook_notifications::manage

• cld::policy::global::prodenv_security::manage

• cld::policy::global::agents::manage

• cld::policy::global::product_environments::view

• cld::policy::global::product_environments::update

• cld::policy::global::reports::delivery::view

• cld::policy::global::reports::errors::view

• cld::policy::global::reports::usage::view

• cld::policy::global::image::access

• cld::policy::global::unnamed_transformations::view

• cld::policy::global::unnamed_transformations::manage

• cld::policy::global::named_transformations::view

• cld::policy::global::named_transformations::delete

• cld::policy::global::named_transformations::update

• cld::policy::global::named_transformations::create

• cld::policy::global::video::access

• cld::policy::global::video:video_analytics::view

• cld::policy::global::video:live_streams::manage

• cld::policy::global::video_player_profiles::manage

• cld::policy::global::video_player_config::manage

• cld::policy::global::media_flows::build

• cld::policy::global::media_flows::connection

• cld::policy::global::media_flows::notification

• cld::policy::global::media_flows::execute_from_assets

• cld::policy::global::cloudinary_moderation::access

• cld::policy::global::agents::taxonomy::invoke

• cld::policy::global::agents::search::invoke

• cld::policy::global::agents::workflow::invoke

Tech Admin - Full policy list

• cld::policy::global::basic_portals::access

• cld::policy::global::specialized_tools_in_assets::access

• cld::policy::global::structured_metadata::access

• cld::policy::global::moderation_queue::access

• cld::policy::global::ml::access

• cld::policy::global::marketplace:manage

• cld::policy::global::marketplace:read

• cld::policy::global::smd:bulk_upload

• cld::policy::global::delivery_url::access

• cld::policy::global::portals::view

• cld::policy::global::rights_management_by_fadel::access

• cld::policy::global::creative_approval::approval_flows::view

• cld::policy::global::creative_approval::proofs::manage

• cld::policy::global::assets::moderate

• cld::policy::global::folder_and_asset_management::delete

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::folder_and_asset_management::public::download

• cld::policy::global::folder_and_asset_management::restricted::download

• cld::policy::global::folder_and_asset_management::create_folder

• cld::policy::global::folder_and_asset_management::create_asset

• cld::policy::global::folder_and_asset_management::update

• cld::policy::global::folder_and_asset_management::update_access_control

• cld::policy::global::restore

• cld::policy::global::public_links::manage

• cld::policy::global::folders::share

• cld::policy::global::collections::create

• cld::policy::global::collections::view

• cld::policy::global::collections::update

• cld::policy::global::collections::invite

• cld::policy::global::dynamic_collections::manage

• cld::policy::global::api_keys::view

• cld::policy::global::api_keys::manage

• cld::policy::global::upload_presets::manage

• cld::policy::global::backup_settings::manage

• cld::policy::global::initiate_backup_settings::manage

• cld::policy::global::assets::bulk_delete_assets

• cld::policy::global::optimization_settings::manage

• cld::policy::global::delivery_settings::manage

• cld::policy::global::webhook_notifications::view

• cld::policy::global::webhook_notifications::manage

• cld::policy::global::prodenv_security::manage

• cld::policy::global::agents::manage

• cld::policy::global::product_environments::view

• cld::policy::global::reports::delivery::view

• cld::policy::global::reports::errors::view

• cld::policy::global::reports::usage::view

• cld::policy::global::image::access

• cld::policy::global::unnamed_transformations::view

• cld::policy::global::unnamed_transformations::manage

• cld::policy::global::named_transformations::view

• cld::policy::global::named_transformations::delete

• cld::policy::global::named_transformations::update

• cld::policy::global::named_transformations::create

• cld::policy::global::video::access

• cld::policy::global::video:video_analytics::view

• cld::policy::global::video:live_streams::manage

• cld::policy::global::video_player_profiles::manage

• cld::policy::global::video_player_config::manage

• cld::policy::global::media_flows::build

• cld::policy::global::media_flows::connection

• cld::policy::global::media_flows::notification

• cld::policy::global::media_flows::execute_from_assets

• cld::policy::global::cloudinary_moderation::access

• cld::policy::global::agents::taxonomy::invoke

• cld::policy::global::agents::search::invoke

• cld::policy::global::agents::workflow::invoke

Media Library Admin - Full policy list

• cld::policy::global::basic_portals::access

• cld::policy::global::specialized_tools_in_assets::access

• cld::policy::global::moderation_queue::access

• cld::policy::global::ml::access

• cld::policy::global::marketplace:manage

• cld::policy::global::marketplace:read

• cld::policy::global::smd:bulk_upload

• cld::policy::global::delivery_url::access

• cld::policy::global::portals::view

• cld::policy::global::rights_management_by_fadel::access

• cld::policy::global::creative_approval::approval_flows::view

• cld::policy::global::creative_approval::proofs::manage

• cld::policy::global::assets::moderate

• cld::policy::global::folder_and_asset_management::delete

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::folder_and_asset_management::public::download

• cld::policy::global::folder_and_asset_management::restricted::download

• cld::policy::global::folder_and_asset_management::create_folder

• cld::policy::global::folder_and_asset_management::create_asset

• cld::policy::global::folder_and_asset_management::update

• cld::policy::global::folder_and_asset_management::update_access_control

• cld::policy::global::restore

• cld::policy::global::public_links::manage

• cld::policy::global::folders::share

• cld::policy::global::collections::create

• cld::policy::global::collections::view

• cld::policy::global::collections::update

• cld::policy::global::collections::invite

• cld::policy::global::dynamic_collections::manage

• cld::policy::global::people::view

• cld::policy::global::people::manage

• cld::policy::global::product_environments::view

• cld::policy::global::unnamed_transformations::view

• cld::policy::global::unnamed_transformations::manage

• cld::policy::global::named_transformations::view

• cld::policy::global::named_transformations::delete

• cld::policy::global::named_transformations::update

• cld::policy::global::named_transformations::create

• cld::policy::global::video_player_config::manage

• cld::policy::global::media_flows::build

• cld::policy::global::media_flows::connection

• cld::policy::global::media_flows::notification

• cld::policy::global::media_flows::execute_from_assets

• cld::policy::global::cloudinary_moderation::access

• cld::policy::global::agents::taxonomy::invoke

• cld::policy::global::agents::search::invoke

• cld::policy::global::agents::workflow::invoke

Media Library User - Full policy list

• cld::policy::global::specialized_tools_in_assets::access

• cld::policy::global::ml::access

• cld::policy::global::rights_management_by_fadel::access

• cld::policy::global::creative_approval::proofs::view

• cld::policy::global::product_environments::view

• cld::policy::global::named_transformations::view

• cld::policy::global::agents::search::invoke

Reports - Full policy list

• cld::policy::global::product_environments::view

• cld::policy::global::reports::delivery::view

• cld::policy::global::reports::errors::view

• cld::policy::global::reports::usage::view

• cld::policy::global::image::access

• cld::policy::global::unnamed_transformations::view

• cld::policy::global::video::access

• cld::policy::global::video:video_analytics::view

• cld::policy::global::cloudinary_moderation::access

Other product environment-level roles

Role ID	Role Name	Description	Policy IDs
cld::role::prodenv::mediaflows_admin	MediaFlows Admin	Manage MediaFlows, structured metadata, API keys, and webhooks, with EasyFlows access via the Media Library.	13 policies (see list below)
cld::role::prodenv::viewer	Viewer	View all folders and assets, with access to the Media Library.	5 policies (see list below)
cld::role::prodenv::contributor	Contributor	All legacy Viewer permissions, plus upload assets and share all folders.	4 policies (see list below)
cld::role::prodenv::editor	Editor	All legacy Contributor permissions, plus moderate, delete, and download all assets, and create folders.	21 policies (see list below)
cld::role::prodenv::moderator	Moderator	Access the Media Library and Moderation page. Can only view or moderate permitted assets.	3 policies (see list below)
cld::role::prodenv::access_to_delivery_url	Delivery URL Viewer	Access original and transformed delivery URLs in the Media Library for assets the user can view.	4 policies (see list below)
cld::role::prodenv::can_create_collections	Collection Creator	Create non-dynamic collections.	3 policies (see list below)
cld::role::prodenv::proof_manager	Proof Manager	Create, view, and delete proofs from assets the user can view.	5 policies (see list below)

MediaFlows Admin - Full policy list

• cld::policy::global::structured_metadata::access

• cld::policy::global::ml::access

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::api_keys::manage

• cld::policy::global::webhook_notifications::manage

• cld::policy::global::product_environments::view

• cld::policy::global::media_flows::build

• cld::policy::global::media_flows::connection

• cld::policy::global::media_flows::notification

• cld::policy::global::media_flows::execute_from_assets

• cld::policy::global::agents::taxonomy::invoke

• cld::policy::global::agents::search::invoke

• cld::policy::global::agents::workflow::invoke

Viewer - Full policy list

• cld::policy::global::ml::access

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::collections::view

• cld::policy::global::people::view

• cld::policy::global::named_transformations::view

Contributor - Full policy list

• cld::policy::global::ml::access

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::folder_and_asset_management::create_asset

• cld::policy::global::folders::share

Editor - Full policy list

• cld::policy::global::moderation_queue::access

• cld::policy::global::ml::access

• cld::policy::global::assets::moderate

• cld::policy::global::folder_and_asset_management::delete

• cld::policy::global::folder_and_asset_management::view

• cld::policy::global::folder_and_asset_management::public::download

• cld::policy::global::folder_and_asset_management::restricted::download

• cld::policy::global::folder_and_asset_management::create_folder

• cld::policy::global::folder_and_asset_management::create_asset

• cld::policy::global::folder_and_asset_management::update

• cld::policy::global::folder_and_asset_management::update_access_control

• cld::policy::global::restore

• cld::policy::global::folders::share

• cld::policy::global::collections::create

• cld::policy::global::collections::view

• cld::policy::global::collections::update

• cld::policy::global::collections::invite

• cld::policy::global::dynamic_collections::manage

• cld::policy::global::people::view

• cld::policy::global::people::manage

• cld::policy::global::named_transformations::view

Moderator - Full policy list

• cld::policy::global::moderation_queue::access

• cld::policy::global::ml::access

• cld::policy::global::product_environments::view

Delivery URL Viewer - Full policy list

• cld::policy::global::specialized_tools_in_assets::access

• cld::policy::global::ml::access

• cld::policy::global::delivery_url::access

• cld::policy::global::product_environments::view

Collection Creator - Full policy list

• cld::policy::global::ml::access

• cld::policy::global::collections::create

• cld::policy::global::product_environments::view

Proof Manager - Full policy list

• cld::policy::global::ml::access

• cld::policy::global::creative_approval::approval_flows::view

• cld::policy::global::creative_approval::proofs::manage

• cld::policy::global::creative_approval::proofs::view

• cld::policy::global::product_environments::view

Folder roles

You can assign the permissions in this section to users, groups, or product environment API keys through folder roles.

Role ID	Role Name	Description	Policy IDs
cld::role::folder::viewer	Viewer	View all assets but only download public ones.	cld::policy::content::folder::view_download cld::policy::content::folder::download_public_assets
cld::role::folder::distributor	Distributor	Viewer permissions, plus share assets publicly.	cld::policy::content::folder::view_download cld::policy::content::folder::download_public_assets cld::policy::content::folder::manage_public_link
cld::role::folder::contributor	Contributor	Viewer permissions, plus add assets and create subfolders.	4 policies (see list below)
cld::role::folder::editor	Editor	Contributor permissions, plus replace, restore versions, and edit assets and subfolders.	10 policies (see list below)
cld::role::folder::manager	Manager	Editor permissions, plus delete, share internally, and download all assets.	18 policies (see list below)

Contributor - Full policy list

• cld::policy::content::folder::view_download

• cld::policy::content::folder::download_public_assets

• cld::policy::content::folder::add_assets

• cld::policy::content::folder::create_subfolders

Editor - Full policy list

• cld::policy::content::folder::view_download

• cld::policy::content::folder::download_public_assets

• cld::policy::content::folder::add_assets

• cld::policy::content::folder::create_subfolders

• cld::policy::content::folder::update_assets

• cld::policy::content::folder::rename_subfolders

• cld::policy::content::folder::rename_assets

• cld::policy::content::folder::rename

• cld::policy::content::folder::moderate

• cld::policy::content::folder::edit_access_control

Manager - Full policy list

• cld::policy::content::folder::view_download

• cld::policy::content::folder::download_public_assets

• cld::policy::content::folder::download_restricted_assets

• cld::policy::content::folder::add_assets

• cld::policy::content::folder::create_subfolders

• cld::policy::content::folder::update_assets

• cld::policy::content::folder::rename_subfolders

• cld::policy::content::folder::rename_assets

• cld::policy::content::folder::delete_assets

• cld::policy::content::folder::delete_subfolders

• cld::policy::content::folder::move_assets

• cld::policy::content::folder::delete

• cld::policy::content::folder::rename

• cld::policy::content::folder::move

• cld::policy::content::folder::move_subfolders

• cld::policy::content::folder::moderate

• cld::policy::content::folder::edit_access_control

• cld::policy::content::folder::invite

Collection roles

You can assign the permissions in this section to users and groups through collection roles.

Role ID	Role Name	Description	Policy IDs
cld::role::collection::viewer	Viewer	View all assets but only download public ones.	cld::policy::content::collection::view cld::policy::content::collection::download_public_assets
cld::role::collection::distributor	Distributor	Viewer permissions, plus share the collection and its assets internally and publicly.	4 policies (see list below)
cld::role::collection::collaborator	Collaborator	Viewer permissions, plus edit details and add assets.	4 policies (see list below)
cld::role::collection::manager	Manager	Collaborator permissions, plus remove assets, delete collection, update details, and download all assets.	8 policies (see list below)

Distributor - Full policy list

• cld::policy::content::collection::view

• cld::policy::content::collection::download_public_assets

• cld::policy::content::collection::mange_public_link

• cld::policy::content::collection::invite

Collaborator - Full policy list

• cld::policy::content::collection::view

• cld::policy::content::collection::download_public_assets

• cld::policy::content::collection::add_assets

• cld::policy::content::collection::update

Manager - Full policy list

• cld::policy::content::collection::view

• cld::policy::content::collection::download_public_assets

• cld::policy::content::collection::download_restricted_assets

• cld::policy::content::collection::add_assets

• cld::policy::content::collection::remove_assets

• cld::policy::content::collection::update

• cld::policy::content::collection::delete

• cld::policy::content::collection::invite

Saved search roles

You can assign the role in this section to users or groups.

Role ID	Role Name	Description	Policy IDs
cld::role::savedsearch::viewer	Saved Search Viewer	View a shared saved search and its results. Results only include assets the user can already view, and the saved search itself can't be modified or deleted.	cld::policy::saved_search::view::view_saved_search