> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit roles and permissions on Astro Private Cloud

The Permission Audit page shows the current state of role assignments across your platform. Use it to answer two kinds of questions:

* Who has access to a given System, Workspace, or Deployment, and through which role?
* What can a specific user, Team, or service account do, and where does that access come from?

To open it, go to **Roles and Permissions** and click **Permission Audit**. The page has two modes: **By entity** and **By principal**.

<Note>
  **Astro Private Cloud 2.1**

  This feature was introduced in Astro Private Cloud 2.1. To access this feature, upgrade your Astro Private Cloud installation to 2.1 or later.
</Note>

<Note>
  Permission Audit shows the current state of role assignments. It doesn't show a history of past changes, such as who created or edited a role.
</Note>

## Prerequisites

* System Admin access to Astro Private Cloud.
* Custom roles enabled in your `values.yaml` file. See [Enable custom roles](/docs/astro-private-cloud/v-2-x/custom-roles#enable-custom-roles).

## Audit by entity

Use **By entity** to see everyone with access to a specific System, Workspace, or Deployment.

<Steps>
  <Step title="Select a scope">
    Select **System**, **Workspace**, or **Deployment**.
  </Step>

  <Step title="Select an entity">
    If you selected **Workspace** or **Deployment**, select the specific entity.
  </Step>
</Steps>

Principals with access appear grouped under **Users**, **Teams**, and **Service accounts**. Each row shows the role a principal holds and its source:

* **Direct**: The role is assigned directly at this entity.
* **Workspace role**: For a Deployment, the role comes from a Workspace-scoped assignment on the Deployment's parent Workspace.
* **System role**: The role comes from a System-scoped assignment, which applies everywhere.

Click a row to expand its effective permissions.

## Audit by principal

Use **By principal** to see everything a specific user, Team, or service account can do.

<Steps>
  <Step title="Select a principal type">
    Select **Users**, **Teams**, or **Service accounts**.
  </Step>

  <Step title="Select a principal">
    Search for the principal, then select it.
  </Step>
</Steps>

Every entity the principal holds a direct role assignment on appears as a row, with its scope and role. Click a row to expand its effective permissions.

<Note>
  **By principal** lists a principal's direct role assignments only. If a user holds a role only through Team membership, that assignment doesn't appear as its own row; it surfaces in the effective permissions panel instead. See [Effective permissions](#effective-permissions).
</Note>

## Effective permissions

Expanding a row shows:

* **Granted by**: The roles contributing permissions at this scope and entity. A role held through Team membership is labeled **via team `<team-name>`**.
* **Effective permissions**: The full set of permissions the principal has at this scope and entity, combining every contributing role.

By default, only granted permissions appear. Turn off **Granted only** to also show the permissions the principal doesn't have at this scope, displayed struck through. Use this view to check for gaps before assigning a role, or to confirm a permission change had the effect you expected.

## Export to CSV

Click **Export CSV** to download the current view as a comma-separated values (CSV) file. In **By entity** mode, the export includes one row per principal with access to the selected entity. In **By principal** mode, it includes one row per entity the selected principal has access to. Each row includes the principal, its type, scope, entity, roles, and effective permissions.

## What's next

* To create a role with a specific set of permissions, see [Create custom roles](/docs/astro-private-cloud/v-2-x/custom-roles).
* For the full list of built-in roles and the permissions they grant, see [User roles and permissions](/docs/astro-private-cloud/v-2-x/role-permission-reference).