Operator roles and capabilities
The five PEEK platform roles, the capabilities each one holds, and how capabilities gate screens and actions.
All PEEK operators
/peek/operatorsAccess in the PEEK center is capability based. Each operator holds one or more platform roles; each role maps to a fixed set of capabilities such as customer.draft or change.review. Every screen declares the capability its primary action needs, shows whether you hold it, and the server enforces it again on every command regardless of what the UI shows.
| Role | Purpose | Key capabilities |
|---|---|---|
| PEEK Platform Administrator | Prepares customers, catalogs, policies and releases. | All read capabilities plus customer.draft, customer.activate, organization.change, identity.configure, every *_catalog.publish / *.publish, policy.*, configuration.publish, configuration.rollback, simulation.run, support.request, audit.read, drift.review, report.generate, offboarding.execute |
| PEEK Technical Reviewer | Independent second person for reviews and verifications. | change.review, initial_admin.verify, exception.review, authority.review, si_evidence.review, recovery.review, connector_change.review, support.review, audit.read, audit.export, drift.review, policy.simulate, preview.use |
| PEEK Entitlement Administrator | Commercial subscriptions only. | organization.read, customer.read, governance.read, entitlement.manage, preview.use |
| PEEK Support Operator | Requests scoped support access. | customer.read, governance.read, connection_governance.read, support.request |
| PEEK Incident Operator | Contains incidents within assigned customers. | customer.read, governance.read, SI/agent/connection governance reads, incident.contain, si.restrict, agent.restrict, connection.restrict |
The read set shared by administrators and reviewers is organization.read, customer.read, policy.read, si_governance.read, agent_governance.read, connection_governance.read, experience_governance.read and governance.read.
How capabilities show on a screen
- Under each screen title is a row of capability badges: ✓ green = you hold it, ✕ grey = you do not.
- If you hold none of the screen’s capabilities, a red Restricted banner replaces the content: *“Your operator assignment does not include … ask the assignment owner for the capability.”*
- Customer scope applies on top of role: an operator scoped to
tenant-acannot open or act on any other tenant, and guessed tenant IDs reveal nothing.
agency.* capabilities. A PEEK operator can never designate themselves as an agency administrator or hold agency membership.Related guides
Operator assignments
Propose, independently review and revoke PEEK operator role grants, customer scope and validity windows.
Catalog lifecycle: draft, review, publish
How every “Publish …” screen works: draft, validation, independent technical review bound to the diff hash, then publish.
Rules and guards
The system-wide rules every PEEK screen and command enforces, independent of the UI.