MetaLens360Help Center

Fix permission denied errors

Understand "Your role does not have permission to do this" messages, which role grants each permission by default, and how to get the access you need.

Updated in Troubleshooting

Overview

Every MetaLens360 user has a role in each workspace: Admin, Architect, Release Manager, DevOps, Developer or Viewer. Roles grant permissions, and the server checks them on every action that changes something or starts work. When you try an action your role doesn't include, you see:

"Your role does not have permission to do this (<permission>)"

The permission key in brackets — for example sync.run — tells you exactly what's missing. Viewing dashboards and analysis is open to everyone; restrictions apply to running, configuring and deleting.

Before you start

  • Find your role: ask a workspace Admin, or check Settings → Users if you can see it.
  • Only Admins can change roles and the permission matrix (Settings → Roles & Permissions).

Steps

  1. Note the permission key in the error message.
  2. Find it in the table below to see which roles have it by default.
  3. Ask a workspace Admin to either change your role or grant that permission to your role in Settings → Roles & Permissions.
  4. After the change, refresh the page and try again.
Permission keyLets youDefault roles
sync.runRun a sync on demandAll except Viewer
index.runIndex or re-index orgsAll except Viewer
comparison.runStart a drift comparisonAll except Viewer
connections.testTest org and Git connectionsAll except Viewer
snapshots.manageCreate and manage snapshotsAll except Viewer
access.manageRun Access 360 scans and triageAll except Viewer
connections.manageAdd, edit or delete org and Git connectionsAdmin, Architect, DevOps
sync.schedules.manageManage sync schedulesAdmin, Architect, Release Manager, DevOps
ai.manageManage AI providers and their orderAdmin, Architect
settings.manageChange general workspace settingsAdmin, Architect
data.deleteDelete connections, snapshots and synced dataAdmin, Architect
team.manageInvite and remove members, change rolesAdmin

Some areas are restricted beyond the matrix:

  • Admin only: team management, the roles and permissions matrix, the audit log and renaming the workspace.
  • Platform admin only: Cloud & Billing, Data Model and Platform Admin. If you open one without access, you're taken back to Home.

Example

Dev, a developer, tries to add acme-uat and sees "Your role does not have permission to do this (connections.manage)". He asks Arjun, the workspace Admin. Arjun decides developers shouldn't manage connections generally, so instead of changing the matrix he adds the org himself. Dev can still test, sync and index it.

FAQs

Some pages say I have read-only access. Is that the same thing?

Yes. Pages such as Sync Schedules and AI Providers show "You have read-only access to sync schedules." or "You have read-only access to AI providers." when your role can view but not change them.

Can a Viewer run anything?

No. Viewers can browse dashboards, analysis, comparisons and Access 360 results, but can't start syncs, comparisons or scans.

Does my role apply in every workspace?

No. Roles are per workspace, so you might be an Admin in one and a Developer in another.

Troubleshooting

I was just given access but still see the error

Refresh the page, or sign out and back in, so your session picks up the new role.

There's no Admin available to help

Contact support from the profile menu → Support.

The error mentions AI and "a key of your own"

That's not a role problem — your workspace requires personal AI keys. See Fix AI provider not configured errors.

Was this article helpful?

Related articles