Access to each part of Interno is controlled by permission scopes. Interno's own scopes all begin with defence:. This article lists the scopes that Interno checks and what each one unlocks.
This page covers Interno only. For every product's scopes in one place, see the Zeron Platform: Complete Permissions & RBAC Reference.
zitadel:iam permission, which is what gates the Admin > Management area where users, groups and policies are maintaineddefence:dashboard:view.zitadel:iam.| To do this | Scope |
|---|---|
| Open dashboards, and the Asset Inventory page | defence:dashboard:view |
| Create a dashboard, use AI dashboard/widget suggestions, import a dashboard | defence:dashboard:create |
| Edit a dashboard (rearrange widgets, save layout changes) | defence:dashboard:update |
| Delete a dashboard | defence:dashboard:delete |
Export Dashboard needs only defence:dashboard:view. Set As Default saves a change to the dashboard, so it requires defence:dashboard:update.
| To do this | Scope |
|---|---|
| See saved widgets and the widget library | defence:widget:view |
| Create or duplicate a widget | defence:widget:create |
| Update a widget | defence:widget:update or defence:widget:create |
| Link or unlink a drill-down widget | defence:widget:update |
| Delete a widget | defence:widget:delete |
| Load the data behind a widget, or preview a query | defence:widget:view or defence:dashboard:view |
The Asset Coverage Matrix and User Access Coverage tabs in Asset Inventory are served as widgets, so viewing them also requires defence:widget:view. The scopes defence:widget:data:view and defence:widget:visualize exist in the permission list but no Interno screen or action currently depends on them.
| To do this | Scope |
|---|---|
| View queries and alerts | defence:query:view |
| Create a query or alert | defence:query:create |
| Edit a query or alert | defence:query:update |
| Delete a query or alert | defence:query:delete |
| Run a query or alert | defence:query:execute |
| To do this | Scope |
|---|---|
| Open the Manual Ingestion page and its history | defence:manual-ingest:view |
| Start an upload | defence:manual-ingest:create |
| Review and approve uploaded data | defence:manual-ingest:review |
Those three scopes decide what the page shows. The work itself — loading the list of uploads, previewing rows, submitting an upload, approving and rejecting — is all checked against defence:query:execute. Grant it to everyone who uses Manual Ingestion, including people who only view.
| To do this | Scope |
|---|---|
| See the Integrations page and the connector catalogue | defence:integration:view |
| See the credentials saved for a tool, and their scan history | defence:integration:credentials:view |
| Add an integration, edit an existing one, start a scan, activate or deactivate | defence:integration:credentials:create |
| Delete an integration | defence:integration:credentials:delete |
Editing an integration is deliberately gated on the same scope as creating one — there is no separate "edit" scope.
| To do this | Scope |
|---|---|
| View risks | defence:risk:view |
| See the Create Risk button | defence:risk:create |
| Open a risk and work through its four steps | defence:risk:manage |
| Save a new risk | defence:risk:create or defence:risk:manage |
| Save a step, or attach evidence | defence:risk:update or defence:risk:manage |
| Delete a risk | defence:risk:delete or defence:risk:manage |
| View documents attached to a risk | defence:risk:documents:view |
In practice a person who raises and works risks needs defence:risk:view, defence:risk:create, defence:risk:manage and defence:risk:documents:view together. Holding defence:risk:manage alone does not show the Create Risk button, and holding defence:risk:update alone does not open a risk. There is no delete action for risks on any Interno screen, whatever scopes are held.
| To do this | Scope |
|---|---|
| See the Evidence tab in the Query Library | grc:evidence:view |
| Create or delete an evidence query | grc:evidence:create |
Read-only analyst defence:dashboard:view, defence:widget:view, defence:query:view, defence:integration:view, defence:integration:credentials:view, defence:risk:view, defence:risk:documents:view
Full Interno user All defence:* scopes above. Add grc:evidence:view and grc:evidence:create if the person works with evidence queries.
Administrator The full Interno user set plus zitadel:iam, so they can manage users, groups and departments.
A user sees the "Unauthorized" screen on a page → Their group is missing that page's scope. Find the row above and add the scope to the group's policy.
A user can open dashboards but cannot rearrange widgets → Editing a dashboard layout requires defence:dashboard:update. Adding widgets to it also needs defence:widget:view.
A user cannot see the Create button on the Dashboard page → That button appears only if the user holds at least one of defence:dashboard:create, defence:widget:create or defence:query:create.
A user cannot add or edit an integration → Add defence:integration:credentials:create in addition to defence:integration:view.
A user can open the Manual Ingestion page but the table is empty or the upload fails → Grant defence:query:execute alongside the defence:manual-ingest: scopes.
A user can see the Risk Register but clicking a risk shows Unauthorized → Opening a risk needs defence:risk:manage.
A user can open a tool's panel under Integrations but sees an Unauthorized image where the credentials should be → Add defence:integration:credentials:view.
An administrator cannot reach Admin > Management → That area requires zitadel:iam.
Need more help? Contact support@zeron.one