Roles and separation of duties
Configure tenant-bound Airlift roles, worker and agent principals, validation producers, and independent approvals.
Roles and separation of duties
Natural-person membership is organization-, principal-type-, and role-bound. Airlift defines five small roles:
| Role | Typical authority |
|---|---|
| Viewer | read projections and evidence |
| Operator | estates, assessments, objects, waves, conversions, profile assignment, waiver requests, cutover submission |
| Approver | wave approval, business acceptance, waiver decisions |
| Validator | parity, validation-run, and readiness records |
| Admin | full tenant administration, including certificate and policy operations |
Trusted workers have a narrow transition set. Harness agents have an even smaller lane:
assessment/object recording and conversion start/record only. Platform installers act
only on the airlift-platform organization registry. Validation principals are admitted
per organization and optionally per provider.
Service accounts may hold the separate automation role. Its machine-checked permissions
cover bounded operational assessment, inventory, planning, transfer, validation,
discrepancy, observation, and evidence work—not approval, waiver, certificate, policy,
membership, or cutover execution. See
organization membership for the exact list.
Submission authorization is repeated immediately before execution. Approval authorization is independent. An agent, converter, or submitter cannot manufacture or inherit a natural person's approval from a workflow signal, form field, or CLI flag.