The following table lists each permission and its description.

Name	Description
User	Default level of permissions for normal users.
Global Admin	Global Administrator with all permissions.
Users View	View users and user information.
Users Modify	Modify existing users.
Users Create	Create new users.
Users Delete	Delete exiting users.
Users Modify Admin	Modify users with Global Admin permissions.
Users Auth Session	Login and logout on behalf of another user.
Groups View	View groups, group members, and group settings.
Groups Modify	Modify group members and settings.
Groups Create	Create new groups.
Groups Delete	Delete existing groups.
Groups View IfMember	View groups you are a member of, excluding system groups.
Groups Modify IfMember	Modify groups you are a member of, excluding system groups.
Groups View System	View groups, group members and group settings of system defined groups.
Groups Modify System	Modify group members and settings of system groups.
Groups Delete System	Delete a system group.
Agents View	View agents and agent settings.
Agents Modify	Modify agent settings.
Agents Create	Create agents.
Agents Delete	Delete existing agents.
Staging View	View staging list and stage configuration settings.
Staging Modify	Modify existing staging settings.
Staging Create	Create new staging configurations.
Staging Delete	Delete existing staging configurations.
Casting View	View casting list and casting configuration settings.
Casting Modify	Modify existing casting settings.
Casting Create	Create new casting configurations.
Casting Delete	Delete existing casting configurations.
Sessions View	View all user sessions.
Sessions Modify	Perform modifications to a session of another user.
Sessions Delete	Delete the session of another user.
Session Recordings View	View user session recordings.
Images View	View images
Images Modify	Modify image configurations.
Images Create	Create new images.
Images Delete	Delete existing images.
Images Modify Resources	Modify image resource settings, such as CPU and Memory settings.
DevAPI View	View developer API list.
DevAPI Modify	Modify developer API configurations.
DevAPI Create	Create a new developer API key.
DevAPI Delete	Delete an existing developer API key.
Webfilters View	View webfilters
Webfilters Modify	Modify existing webfilters
Webfilters Create	Create a new webfilter.
Webfilters Delete	Delete an existing webfilter
Brandings View	View branding configurations.
Brandings Modify	Modify existing branding configurations.
Brandings Create	Create new branding configurations.
Brandings Delete	Delete existing branding configurations.
Settings View	View global settings.
Settings Modify	Modify global settings in all categories.
Settings Modify Auth	Modify global settings in the authentication category.
Settings Modify Auth Captcha	Modify global settings in the authentication captcha category.
Settings Modify Cast	Modify global settings in the casting category.
Settings Modify Images	Modify global settings in the images category.
Settings Modify License	Modify global settings in the license category.
Settings Modify Logging	Modify global settings in the logging category.
Settings Modify Manager	Modify global settings in the manager category.
Settings Modify Scale	Modify global settings in the scale category.
Settings Modify Subscription	Modify global settings in the subscription category.
Settings Modify Filter	Modify global settings in the filter category.
Settings Modify Storage	Modify global settings in the storage category.
Settings Modify Connections	Modify global settings in the connections category.
Settings Modify Theme	Modify global settings in the theme category.
Auth View	View LDAP/OIDC/SAML configurations.
Auth Modify	Modify LDAP/OIDC/SAML configurations.
Auth Create	Create LDAP/OIDC/SAML configurations.
Auth Delete	Delete LDAP/OIDC/SAML configurations.
Licenses View	View licenses.
Licenses Create	Add new licenses.
Licenses Delete	Delete licenses.
System View	View system information.
System Export Schema	Export system schema.
System Import Data	Import system data.
System Export Data	Export system data.
Reports View	View system reports and logging. Warning: Providing access to logs can provide a lot of potentially sensitive information.
Managers View	View the managers.
Managers Modify	Modify existing managers.
Managers Create	Create a new manager.
Managers Delete	Delete existing managers.
Zones View	View Zones and Zone settings.
Zones Modify	Modify Zone settings.
Zones Create	Create new Zones.
Zones Delete	Delete existing Zones.
Companies View	View companies.
Companies Modify	Modify existing company.
Companies Create	Create a new company.
Companies Delete	Delete an existing company.
Connection Proxy View	View connection proxies.
Connection Proxy Modify	Modify connection proxies.
Connection Proxy Create	Create a connection proxy.
Connection Proxy Delete	Delete an existing connection proxy.
Physical Tokens View	View physical 2FA tokens.
Physical Tokens Modify	Assign/Unassign physical 2FA tokens.
Physical Tokens Create	Import or create physical 2FA tokens.
Physical Tokens Delete	Delete a physical 2FA token.
Servers View	View servers.
Servers Modify	Modify existing servers.
Servers Create	Create new servers.
Servers Delete	Delete servers.
Server Pools View	View server pools.
Server Pools Modify	Modify server pools.
Server Pools Create	Create a new server pool.
Server Pools Delete	Delete a server pool.
Autoscale View	View AutoScale configurations.
Autoscale Modify	Modify an existing AutoScale configuration.
Autoscale Create	Create a new AutoScale configuration.
Autoscale Delete	Delete AutoScale configurations.
VM Provider View	View VM Provider configurations.
VM Provider Modify	Modify VM Provider configurations.
VM Provider Create	Create new VM Provider configurations.
VM Provider Delete	Delete VM Provider configurations.
Autoscale Schedule View	View an AutoScale schedule.
Autoscale Schedule Modify	Modify an AutoScale schedule.
Autoscale Schedule Create	Create an AutoScale schedule.
Autoscale Schedule Delete	Delete an AutoScale schedule.
DNS Providers View	View DNS provider configurations.
DNS Providers Modify	Modify DNS provider configurations.
DNS Providers Create	Create new DNS Provider configurations.
DNS Providers Delete	Delete DNS Provider configurations.
Registries View	View Workspace Registries.
Registries Modify	Modify existing Workspace Registries.
Registries Create	Add new Workspace Registries
Registries Delete	Delete a Workspace Registry
Storage Providers View	View Storage Providers.
Storage Providers Modify	Modify existing Storage Providers.
Storage Providers Create	Create new Storage Providers.
Storage Providers Delete	Delete an existing Storage Provider.
Egress Providers View	View Egress Providers.
Egress Providers Modify	Modify existing Egress Providers.
Egress Providers Create	Create new Egress Providers.
Egress Providers Delete	Delete an existing Egress Provider.
Egress Gateways View	View Egress Gateways.
Egress Gateways Modify	Modify existing Egress Gateways.
Egress Gateways Create	Create new Egress Gateways.
Egress Gateways Delete	Delete an existing Egress Gateway.
Egress Credentials View	View Egress Credentials.
Egress Credentials Modify	Modify existing Egress Credentials.
Egress Credentials Create	Create new Egress Credentials.
Egress Credentials Delete	Delete an existing Egress Credential.
Banners View	View banners.
Banners Modify	Modify existing banners.
Banners Create	Create new banners.
Banners Delete	Delete an existing banner.
AD User Management View	View AD User Management Configurations.
AD User Management Modify	Modify existing AD User Management Configurations.
AD User Management Create	Create new AD User Management Configurations.
AD User Management Delete	Delete an existing AD User Management Configuration.

Permission changes

Kasm embeds a user's permissions in their session token, which is generated on login. The Session Lifetime global setting controls the token lifetime. The UI requests a new session token every 5 minutes. To apply new permissions fastest, have the user log out and log back in. Otherwise, the change applies within 5 minutes.

Permission dependencies

Most permissions stand alone, but some permissions depend on others. Generally, a Modify, Create, or Delete permission needs the corresponding View permission. The following additional dependencies require you to grant multiple permissions to achieve the desired effect.

• Licenses View requires System View
• Permissions View requires Groups View
• Registries View requires Images View, System View, and Agents View
• Autoscale View requires Server Pools View
• Autoscale Schedule View requires Server Pools View
• DNS Providers View requires Server Pools View
• VM Providers View requires Server Pools View and Autoscale View
• Users Delete requires Sessions Delete if the target user has running sessions and Users Modify
• Users Delete requires Users Modify Admin to delete a user that has the Global Admin permission
• Egress Gateways Create, Egress Gateways Modify, Egress Gateways Delete, Egress Credentials Create, Egress Credentials Modify and Egress Credentials Delete require Egress Providers Modify.
• Servers View and Server Templates View requires Server Pools View and Zones View

In many cases multiple permissions are not required. However, Kasm hides certain UI elements when the user lacks the permissions to view them. For example, a user may have View Images permissions but not View Servers permissions. When that user views an individual Workspace Image that targets a Server, the drop-down to view or edit the targeted server stays hidden.

Special permissions

Groups offer more permissions beyond the basic View, Create, Modify, and Delete actions. The Groups View IfMember and Groups Modify IfMember permissions allow a user to view or modify a group when they are a member of that group. This access does not extend to built-in system groups (All Users and Administrator). To edit or view system groups, the user also needs the Groups View/Modify System permission.

An additional permission protects the modification of users with the Global Admin permission. To modify a Global Admin, the requesting user must be a Global Admin or hold the User Modify Admin permission.

Two permissions allow modifications to Workspace Images: Images Modify and Images Modify Resources. The Images Modify permission allows modification of all Image settings except those that change the physical or virtual compute resources. The following settings require the Images Modify Resources permission to edit:

• GPU Count
• Cores
• Memory
• CPU Allocation Method
• Uncompressed Image Size
• Docker Registry
• Docker Registry Username
• Docker Registry Password
• Hash
• Volume Mappings
• Docker Run Config Override
• Docker Exec Config