Organization permissions

Organization-level permissions apply to all projects, Stacks, and workspaces within an organization.

Background

If you are in an HCP Terraform organization, you can manage user access and permissions through teams. Refer to the following topics for information about setting permissions in HCP Terraform:

• Set permissions
• Project permissions reference
• Workspace permissions reference
• Effective permissions provides information about competing permissions.

All organization permissions

The following table summarizes the available organization-level permission categories. Click on a specific permission to learn more about what that permission grants.

Project permissions

The following table summarizes the available organization-level permissions for projects. Click on a specific permission name to learn more about that permission level.

None

Members do not have access to projects or workspaces and Stacks. You can grant permissions to individual projects or workspaces and Stacks through Project Permissions or Workspace Permissions.

View all projects

Members can view all projects within the organization. This lets users:

• View project names in a given organization.

Manage all projects

Members can create and manage all projects and workspaces or Stacks within the organization. In addition to the permissions granted when enabling the Manage all workspaces permission, this also lets users perform the following actions:

• Manage other teams' access to all projects.
• Create, edit, and delete projects that are otherwise only available to organization owners.
• Create, read, update, and delete Stacks.
• Initiate, cancel, or apply runs for Stacks.
• Move workspaces and Stacks between projects.

Workspace permissions

The following table summarizes the available organization-level permissions for workspaces. Click on a specific permission name to learn more about that permission level.

None

Members do not have access to projects or workspaces. You can grant permissions to individual projects or workspaces through Project Permissions or Workspace Permissions.

View all workspaces

Members can view all workspaces within the organization. This lets users view information and features relevant to each workspaces, such as runs, state versions, variables.

Manage all workspaces

Members can create and manage all workspaces within the organization. This lets users perform the following actions:

• Any action that requires admin permissions in those workspaces.
• Create new workspaces within the organization's Default Project, which is an action that is otherwise only available to organization owners.
• Create, update, and delete variable sets.

Group Permissions

In HashiCorp Cloud Platform (HCP) Europe organizations, you manage user access through HCP groups, and use group permissions instead of team permissions. To learn more, refer to Use HCP Terraform in Europe.

You cannot manually assign Group permissions to a group in HCP Terraform. Instead, you must assign an HCP role to that group which grants Group permissions, then HCP Terraform automatically inherits those permissions. To learn more about which HCP roles grant group permissions, refer to HCP group roles.

Team permissions

Team permissions are available in standard HCP Terraform organizations.

You can enable the following team management permissions in HCP Terraform:

• Manage membership
• Manage teams
• Manage organization access

Each permission level grants users the ability to perform specific actions and each progressively requires prerequisite permissions.

For example, you must have the Manage teams permission to grant another user the Manage teams permission, and that user must already have Manage membership permissions. To grant a user Manage organization access, a user must already have Manage membership and Manage teams permissions.

Manage membership

Allows members to invite users to the organization, remove users from the organization, and add or remove users from teams within the organization.

This permission grants the ability to view the list of users within the organization, and to view the organization access of other visible teams. It does not permit the creation of teams, the ability to modify the settings of existing teams, or the ability to view secret teams.

In order to modify the membership of a team, the user must be a member of a team with the Manage membership permissions enabled and the Visible setting must be enabled for the team. The user can also be a member of the team if the Visible setting is disabled. In order to remove a user from the organization, the holder of this permission must have visibility into all of the teams which the user is a member of.

Manage teams

Allows members to create, update, and delete teams. It also lets members generate and revoke tokens.

This permission grants the ability to update a team's names, SSO IDs, and token management permissions, but does not allow access to organization settings. On its own, this permission does not allow users to create, update, delete, or otherwise access secret teams.

The manage teams permission confers all permissions granted by the manage membership permission.

This permission allows owners of large organizations to delegate team management to another trusted team. You should only grant it to teams of trusted users.

Manage organization access

Allows members to update a team's organization access settings.

On its own, this permission does not allow users to create, update, delete, or otherwise access secret teams. This permission confers all of the permissions granted by the manage teams and manage membership permissions.

This permission allows owners of large organizations to delegate team management to another trusted team. You should only grant it to teams of trusted users.

Include secret teams

Allows members access to secret teams at the level permitted by that user's team permissions setting.

This permission modifies existing team management permissions. Members with this permission can access secret teams up to the level permitted by other team management permissions. For example, if a user has permission to include secret teams and manage teams, that user can create secret teams.

Allow member token management

Allows owners and members with manage teams permissions to enable and disable team token management for team members. This permission defaults to true.

When member token management is enabled, members will be able to perform actions on team tokens, including generating and revoking a team token.

When member token management is disabled, members will be unable to perform actions on team tokens, including generating and revoking a team token.

Settings permissions

The following permissions control access to governance and infrastructure tools.

Manage policies

Allows members to create, edit, read, list and delete the organization's Sentinel policies.

This permission implicitly gives permission to read runs on all workspaces, which is necessary to set enforcement of policy sets.

Manage run tasks

Allows members to create, edit, and delete run tasks on the organization.

Manage policy overrides

Allows members to override soft-mandatory policy checks.

This permission implicitly gives permission to read runs on all workspaces, which is necessary to override policy checks.

Manage VCS settings

Allows members to manage the set of VCS providers and SSH keys available within the organization.

Manage agent pools

Allows members to create, edit, and delete agent pools within their organization.

This permission implicitly grants access to read all workspaces and projects, which is necessary for agent pool management.

Private registry permissions

The following permissions control access to the organization's private registry.

Manage private modules

Allow members to publish and delete modules in the organization's private registry.

Manage private providers

Allow members to publish and delete providers in the organization's private registry.

Public registry permissions

The following permissions control access to providers and modules using an organization's claimed namespaces in the public registry.

Manage public modules

Allow members to publish and delete modules for the organization in the public registry.

Manage public providers

Allow members to publish and delete providers for the organization in the public registry.

Organization owners

Every organization has an Owners team whose members have the maximum available permissions within the organization. This includes all organization-level permissions and the highest level of permissions on every workspace and Stack.

There are also some actions within an organization that are only available to owners. These are generally actions that affect the permissions and membership of other teams, or are otherwise fundamental to the organization's security and integrity.

The organization owners team has the following permissions:

HCP group roles

In an HCP Europe organization, you manage user access through groups. To learn how to set up groups and assign users to them in HCP, refer to Groups. To learn more about HCP Terraform in Europe, refer to Use HCP Terraform in Europe.

You can assign permissions to HCP groups in two ways:

• HCP roles - You can assign HCP roles to groups in the HashiCorp Cloud Platform (HCP), and these roles automatically grant permissions in HCP Terraform.
• [HCP Terraform roles](/terraform/cloud-docs/users-teams-organizations/permissions/set-permissions#set-organization-level-permissions - Assign additional permissions at the organization, project, and workspace level to further refine group access in HCP Terraform.

Each permission a user is granted is additive. HCP Terraform grants a user the highest permissions possible, regardless of whether that permission was set by an HCP or HCP Terraform role.

The following table lists which organization-level permissions each HCP role automatically grants in HCP Terraform: