<a id="manage-permissions"></a>

# Manage permissions

> See first: [Juju | Juju access levels](https://canonical.com/juju/docs/juju-cli/3.6/reference/user/#user-access-levels)

> See also: [Authorization](https://documentation.ubuntu.com/jaas/latest/explanation/jaas-authorization.md#jaas-authorization)

<a id="add-a-permission"></a>

## Add a permission

To add a permission between an entity A (always a user, whether identified directly or through a group/role) and an entity B (group, role, or resource – controller, cloud, model, or application offer), run the `add-permission` command followed by A (in tag notation or alternatives), the desired B-supported permission, and B (in tag notation). For example:

```text
# Make Alice cloud admin:
juju add-permission user-alice@canonical.com administrator cloud-mycloud

# Let all users add models on the cloud:
juju add-permission user-everyone@external can_addmodel cloud-mycloud

# Make Alice model admin:
juju add-permission user-alice@canonical.com administrator model-mycontroller/mymodel

# Let all users with role myrole have read access to model mymodel:
juju add-permission role-myrole#assignee reader model-mycontroller/mymodel

# Let Alice consume offer myoffer:
juju add-permission user-alice@canonical.com consumer applicationoffer-mycontroller/mymodel.myoffer

# Add Bob and Cindy to the mygroup group:
juju add-permission user-bob@canonical.com member group-mygroup
juju add-permission user-cindy@canonical.com member group-mygroup

# Let everyone in group mygroup add models that will use resources from cloud my-cloud:
juju add-permission group-mygroup#member can-addmodel cloud-mycloud
```

| entity A                                                                                                  | permission                                                                                             | entity B                                                                     |
|-----------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|
| [user tag or alternatives except for role assignee](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag) | [assignee](https://documentation.ubuntu.com/jaas/latest/reference/role.md#role-permission-assignee)                       | [role tag](https://documentation.ubuntu.com/jaas/latest/reference/role.md#role-tag)             |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [member](https://documentation.ubuntu.com/jaas/latest/reference/group.md#group-permission-member)                          | [group tag](https://documentation.ubuntu.com/jaas/latest/reference/group.md#group-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [can_addmodel](https://documentation.ubuntu.com/jaas/latest/reference/controller.md#controller-permission-can-addmodel)         | [controller tag](https://documentation.ubuntu.com/jaas/latest/reference/controller.md#controller-tag) |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [audit_log_viewer](https://documentation.ubuntu.com/jaas/latest/reference/controller.md#controller-permission-audit-log-viewer) | [controller tag](https://documentation.ubuntu.com/jaas/latest/reference/controller.md#controller-tag) |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [administrator](https://documentation.ubuntu.com/jaas/latest/reference/controller.md#controller-permission-administrator)       | [controller tag](https://documentation.ubuntu.com/jaas/latest/reference/controller.md#controller-tag) |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [can_addmodel](https://documentation.ubuntu.com/jaas/latest/reference/cloud.md#cloud-permission-can-addmodel)              | [cloud tag](https://documentation.ubuntu.com/jaas/latest/reference/cloud.md#cloud-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [administrator](https://documentation.ubuntu.com/jaas/latest/reference/cloud.md#cloud-permission-administrator)            | [cloud tag](https://documentation.ubuntu.com/jaas/latest/reference/cloud.md#cloud-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [reader](https://documentation.ubuntu.com/jaas/latest/reference/model.md#model-permission-reader)                          | [model tag](https://documentation.ubuntu.com/jaas/latest/reference/model.md#model-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [writer](https://documentation.ubuntu.com/jaas/latest/reference/model.md#model-permission-writer)                          | [model tag](https://documentation.ubuntu.com/jaas/latest/reference/model.md#model-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [administrator](https://documentation.ubuntu.com/jaas/latest/reference/model.md#model-permission-administrator)            | [model tag](https://documentation.ubuntu.com/jaas/latest/reference/model.md#model-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [reader](https://documentation.ubuntu.com/jaas/latest/reference/offer.md#offer-permission-reader)                          | [offer tag](https://documentation.ubuntu.com/jaas/latest/reference/offer.md#offer-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [consumer](https://documentation.ubuntu.com/jaas/latest/reference/offer.md#offer-permission-consumer)                      | [offer tag](https://documentation.ubuntu.com/jaas/latest/reference/offer.md#offer-tag)           |
| [user tag or alternatives](https://documentation.ubuntu.com/jaas/latest/reference/user.md#user-tag)                          | [administrator](https://documentation.ubuntu.com/jaas/latest/reference/offer.md#offer-permission-administrator)            | [offer tag](https://documentation.ubuntu.com/jaas/latest/reference/offer.md#offer-tag)           |

For any given resource, permissions are currently hierarchical and some permissions are implicit – e.g., given a cloud associated with a controller and a model associated with the cloud, a controller `administrator` entails cloud `administrator` entails cloud `can_addmodel`.

> See more: [juju add-permission](https://documentation.ubuntu.com/jaas/latest/reference/jaas-plugin.md)

<a id="verify-a-permission"></a>

## Verify a permission

Given two entities A and B, to verify that there is a specific permission between them, run the `check-permission` command followed by the tag of A, the permission, and the tag of B. For example:

```text
juju check-permission user-alice@canonical.com administrator controller-aws-controller-1
```

> See more: [juju check-permission](https://documentation.ubuntu.com/jaas/latest/reference/jaas-plugin.md)

<a id="view-all-the-current-permissions"></a>

## View all the current permissions

To view all the current permissions, run the `list-permissions` command. For example:

```text
juju list-permissions [options]
```

> See more: [juju list-permissions](https://documentation.ubuntu.com/jaas/latest/reference/jaas-plugin.md)

<a id="remove-a-permission"></a>

## Remove a permission

Given two entities A and B and a pre-existing permission between them, to remove the permission, run the `remove-permission` command followed by the tag of A, the permission, and the tag of B. For example:

```text
juju remove-permission user-alice@canonical.com member group-mygroup
```

> See more: [View all the current permissions](#view-all-the-current-permissions), [juju remove-permission](https://documentation.ubuntu.com/jaas/latest/reference/jaas-plugin.md)