Roles

kogut has two roles for one team, with no organisations, projects, or per-service permissions.

Permissions

Action	Viewer	Admin
Read monitoring data, analytics, errors, and settings	Yes	Yes
Use Copy for AI on an incident	Yes	Yes
See addresses of panel notification channels	No	Yes
Acknowledge incidents	No	Yes
Add hosts, sites, and checks	No	Yes
Get agent install commands, tracking snippets, and heartbeat ping URLs	No	Yes
Change or delete checks and heartbeats	No	Yes
Monitor or dismiss discovered services	No	Yes
Approve or reject checks proposed over MCP	No	Yes
Manage channels, send tests, and manage silences and maintenance	No	Yes
Add people and create or revoke API tokens	No	Yes

A viewer’s write returns “only admins can do this”, and the panel hides those actions. Objects from kogut.toml are read-only in the panel for both roles.

Role assignment

The first account is an admin, created with the setup token or by an admin-group member through single sign-on. Admins choose roles in Settings → People. The panel cannot change roles or remove accounts.

With admin_groups, OpenID Connect sets roles at sign-in and forward auth on every request: group members are admins, others viewers. Without admin_groups, existing accounts keep their roles and new accounts are viewers.

API tokens

Tokens have scopes, not roles. A read token has viewer access. A write token adds admin actions except managing people and tokens, which needs an admin signed in to the panel. A deploy token only records deploys. An mcp token only reaches MCP, where it can propose checks but not approve them. Only admins create tokens.