Roles and permissions
A role is a named set of capabilities owned by your team. A folder share applies the same idea to one corner of the fleet.
Deciding what each person can do, using a role or a folder share.
How it works
A capability is one action: deploy_apps, delete_apps,
manage_domains, restore_backups. There are 44 and they are
deliberately not bundled, because an administrator who can only grant
"deploy and delete together" ends up granting too much.
A role is a row owned by your team, not a fixed preset. Every team starts with three you can rename, re-scope and later reset to what Deplo ships:
Prop
Type
Editing a role rewrites the capabilities of everyone holding it, in the same transaction. There is no separate "apply" step and no drift between what the role says and what its members can do.
A folder share works differently: it does not edit a role, it replaces one at a single node in the tree. See Folder shares for how that combines with a team role.
The floor and the ceiling
viewis the always-on floor. Every member has it.instanceAdminis not a team capability at all. It unlocks Servers, Users and the instance settings, and it is granted from the member's Advanced tab by another instance admin.canExposePortsandcanMountHostVolumesare separate grants. The second one is the serious one: it covers every route out of a container, not just a bind mount. See Host access.
Limits and gotchas
- The interface only hides buttons. The real check happens server-side before every write, and the API and the MCP server pass through the same code. A hidden button is not a security boundary and is not treated as one.
- A role edit is immediate for everyone holding it.
- No edit may orphan the team.
manage_members,manage_rolesandmanage_teammust always have a holder. - An id from another team resolves to nothing, rather than to an error that would confirm it exists.
- API tokens are capped by their creator. A token can never do more than the person who made it can do right now, so narrowing somebody's role immediately narrows every token they minted.
If it does not work
- A capability is greyed out while editing a role: you do not hold it yourself.
- Somebody still cannot do the thing: check for a folder share on that node, which replaces the team role there, and check whether the team requires two-factor.
- They can do more than their role says: a folder share is granting it. Their member page shows the scope tree.
See Sign-in and access for more.
See also
Did this page help you?