Skip to main content
Every Beam pipeline config is governed by per-resource access control. Each user’s effective access on a config is derived from one or more roles granted directly to them or to a team they belong to. When you create a pipeline, you automatically become its owner, and every member of your team is granted read access to it.

​
Roles

Roles are granted on a per-config basis. A user can hold at most one user-level role per config; team-level roles stack with whatever the user already has.
RoleGranted toPermissions
OwnerUserRead, edit, and manage. Can deploy, teardown, share, and delete the pipeline. Can grant or revoke any role on the config.
EditorUserRead and edit. Can change pipeline configuration and redeploy, but cannot share, transfer ownership, or delete the pipeline.
ReaderUserRead-only. Can view the pipeline config, deployment state, and metrics. Cannot make changes.
Team viewerTeamRead-only, granted to every member of the team. Used to give teammates visibility without enumerating users one by one.

​
Permissions

Each role resolves into a set of permissions that gate API behaviour:
PermissionOwnerEditorReaderTeam viewer
read — view config, deployment status, metrics✓✓✓✓
edit — modify config, deploy, teardown✓✓
manage — share, transfer ownership, delete✓
A user’s effective permission on a config is the union of every role they hold on it, directly or through a team.

​
Default access on a new pipeline

When a pipeline is created:
  1. The creating user is granted owner on the config.
  2. The creator’s team is granted team viewer, so every teammate gets read access automatically.
No other users or teams have access until an owner grants it.

​
Sharing a pipeline

Owners can grant additional access from the pipeline settings:
  • Add a user as editor or reader — gives that one user the corresponding permissions, independent of their team membership.
  • Add a team as viewer — gives every member of that team read access. Useful for opening up visibility to a partner team without listing individuals.