# Roles

Permissions for admins, viewers, and API tokens.

kogut has two roles for one team, with no organisations, projects, or per-service
permissions.

## Permissions

| Action | Viewer | Admin |
|---|---|---|
| Read monitoring data, analytics, errors, and settings | Yes | Yes |
| Use **Copy for AI** on an incident | Yes | Yes |
| See addresses of panel notification channels | No | Yes |
| Acknowledge incidents | No | Yes |
| Add hosts, sites, and checks | No | Yes |
| Get agent install commands, tracking snippets, and heartbeat ping URLs | No | Yes |
| Change or delete checks and heartbeats | No | Yes |
| Monitor or dismiss discovered services | No | Yes |
| Approve or reject checks proposed over [MCP](https://docs.kogut.dev/reference/mcp/#drafts) | No | Yes |
| Manage channels, send tests, and manage silences and maintenance | No | Yes |
| Add people and create or revoke API tokens | No | Yes |

A viewer's write returns "only admins can do this", and the panel hides those actions.
Objects from `kogut.toml` are read-only in the panel for both roles.

## Role assignment

The first account is an admin, created with the setup token or by an admin-group member
through single sign-on. Admins choose roles in **Settings → People**. The panel cannot
change roles or remove accounts.

With `admin_groups`, [OpenID Connect](https://docs.kogut.dev/sign-in/openid-connect/) sets roles at sign-in and
[forward auth](https://docs.kogut.dev/sign-in/forward-auth/) on every request: group members are admins, others
viewers. Without `admin_groups`, existing accounts keep their roles and new accounts are
viewers.

## API tokens

Tokens have [scopes](https://docs.kogut.dev/reference/http-api/#authentication), not roles. A `read` token has
viewer access. A `write` token adds admin actions except managing people and tokens,
which needs an admin signed in to the panel. A `deploy` token only records deploys. An
`mcp` token only reaches MCP, where it can propose checks but not approve them. Only
admins create tokens.