Default RBAC Roles and Permissions

SandWork utilizes Role-Based Access Control (RBAC) to ensure secure and granular access management across the system. The platform is pre-configured with four default roles, each tailored to specific administrative or operational scopes.

Roles are assigned to user in per namespace scope. Meaning, that single user can have different roles in different namespaces.

Below is the comprehensive mapping of these default roles and their permitted modules and actions.

1 Default RBAC Roles and Permissions
2 Appendix: Glossary of RBAC Modules and Actions

DC Viewer (dc-viewer)

Description: This role has read-only access to a namespace.

Module	Permitted Actions
inventory	read
rbac-password-rules	read
workflow-queue	see-all

DC Admin (dc-admin)

Description: This role is allowed to execute Day 2 operations and device checks.

Module	Permitted Actions
brownfield	import, pull
cable-check	execute
configure-bgp	execute
configure-extended-mappings	execute
configure-routing-policy	execute
device-configuration-snapshot	pull-and-store, push, store
device-management-connectivity-check	execute
device-staging	config_pending-config_ready-transition, config_ready-managed-transition, connected-onboarded-transition, managed_conflict-managed-transition, onboarded-config_pending-transition
device-traffic	disable, enable, inventory-update-default-traffic-configuration-params
devices-neighbors	pull
dhcp-relay	create, delete, update
find-server-by-ip-address	execute
find-server-by-mac-address	execute
finish-rma	execute
import-bulk-extended-mappings	execute
inventory	read
label-management-devices	execute
label-management-interfaces	execute
loopback	create, delete
mapping-to-switchport	add, remove
network-segment	create, delete, merge
os-upgrade-validation	execute
port-breakout-change	execute
port-settings	execute
portchannel	create, delete, update
rbac-password-rules	read
reconciliation	create-ignored-intent-records, execute, push-gfs-aaa, push-gfs-ntp, push-gfs-password, push-gfs-radius, push-gfs-snmp, push-gfs-tacacs, push-greenfield, push-loopback, push-port-breakouts, push-port-settings, push-port_channel, push-port_group-settings, push-switchport-mappings, push-traffic-settings, remove-extra-configuration, remove-ignored-intent-records
start-rma	execute
workflow-queue	see-all

DC Super Admin (dc-super-admin)

Description: This role is allowed to execute device lifecycle operations and operations with higher impact (such as configuring Global Fabric Settings).

Module	Permitted Actions
brownfield	import, pull
cable-check	execute
cleanup	cleanup-device-intents
configure-aaa	execute
configure-bgp	execute
configure-extended-mappings	execute
configure-ntp	execute
configure-radius	execute
configure-routing-policy	execute
configure-snmp	execute
configure-tacacs	execute
data-centre	export, import
device-configuration-snapshot	pull-and-store, push, store
device-decommission	execute
device-management-connectivity-check	execute
device-model	change
device-profile	delete, persist
device-staging	config_pending-config_ready-transition, config_ready-managed-transition, connected-onboarded-transition, force-change-stage, managed-config_ready-transition, managed_conflict-config_pending-transition, managed_conflict-managed-transition, onboarded-config_pending-transition, os_install-os_install_failure-transition, os_install_failure-config_pending-transition, os_install_failure-managed-transition
device-traffic	disable, enable, inventory-update-default-traffic-configuration-params
devices-neighbors	pull
dhcp-relay	create, delete, update
find-server-by-ip-address	execute
find-server-by-mac-address	execute
finish-rma	execute
greenfield	dc-replace, dc-setup-init, rendering
import-bulk-extended-mappings	execute
inventory	read
inventory-view	export, import
label-management-devices	execute
label-management-interfaces	execute
loopback	create, delete
mapping-to-switchport	add, remove
network-segment	create, delete, merge
os-image	update
os-upgrade	execute
os-upgrade-validation	execute
port-breakout-change	execute
port-settings	execute
portchannel	create, delete, update
rbac-password-rules	read
reconciliation	create-ignored-intent-records, execute, push-gfs-aaa, push-gfs-ntp, push-gfs-password, push-gfs-radius, push-gfs-snmp, push-gfs-tacacs, push-greenfield, push-loopback, push-port-breakouts, push-port-settings, push-port_channel, push-port_group-settings, push-switchport-mappings, push-traffic-settings, remove-extra-configuration, remove-ignored-intent-records
start-rma	execute
update-gfs-password	execute
workflow-queue	see-all

Administrative Admin (administrative-admin)

Description: This role is allowed to manage users, roles of users and domains in SandWork deployment.

Scope: Global across all namespaces (*).

Module	Permitted Actions
rbac-domain	manage, read
rbac-namespace	read
rbac-password-rules	read
rbac-permission	read
rbac-role	read
rbac-user	manage, read

Appendix: Glossary of RBAC Modules and Actions

To better understand the permissions granted by SandWork's default roles, the system's operational modules and their associated actions are defined below, grouped by functional area.

Identity & Access Management (IAM)

These modules control user access, authentication, and security policies.

rbac-domain: Manages SSO/OIDC domain integrations (e.g., mapping @company.com to an external identity provider).
rbac-namespace: Manages the logical separation of datacenters (namespaces).
rbac-password-rules: Views or manages local user password complexity requirements (minimum length, special characters, etc.).
rbac-role / rbac-permission: Manages custom roles and their specific module/action permissions.
rbac-user: Manages user accounts, assigns roles, and triggers password resets.

Data Center Design & Onboarding

These modules handle the initial physical layout, hardware templates, and device onboarding.

data-centre (import, export): Uploads or downloads the DC Plan file, which defines the physical topology, pods, racks, and intended cabling.
device-profile (persist, delete): Manages hardware templates that define port layouts, default speeds, and breakout capabilities for specific switch models.
inventory-view (import, export): Uploads or downloads the Inventory file, which maps physical devices to their management IPs, hostnames, and credentials.
device-model (change): Updates the hardware layout model of a specific device in the inventory.

Device Lifecycle & Staging

These modules move devices through strict operational states (stages).

device-staging: Controls the lifecycle of a switch. Actions like connected-onboarded-transition, config_ready-managed-transition, etc., move devices safely through the deployment pipeline (e.g., verifying cabling, pushing configs, and enabling traffic). force-change-stage allows an admin to bypass standard checks.
device-decommission (execute): Decommissions devices by their IDs, with an option to remove existing service intents of the devices.
start-rma / finish-rma (execute): Manages the Return Merchandise Authorization (RMA) process for physically replacing faulty hardware while preserving its intended configuration.

Day 1 Operations (Infrastructure)

These modules set up the core fabric and global settings required before network services can be deployed.

greenfield (dc-setup-init): Creates the initial greenfield intent for a given namespace within the inventory.
brownfield (import, pull): Allows administrators to populate SandWork's database by importing a JSON file of existing network intents, or by pulling (extracting) configurations directly from live, running devices.
configure-aaa / configure-ntp / configure-radius / configure-snmp / configure-tacacs / update-gfs-password: Manages Global Fabric Settings (GFS), applying consistent administrative configurations across all devices in a POD.

Day 2 Operations (Network Services)

These modules manage active network traffic, routing, and interface configurations.

network-segment (create, merge, delete): Manages VXLAN subnets, defining IP ranges and Anycast Gateways.
mapping-to-switchport (add, remove): Binds Network Segments (VLANs/VNIs) to specific physical ports or PortChannels.
port-settings (execute): Modifies properties of a physical port, such as Admin Status (Up/Down), Speed, MTU, and FEC mode.
port-breakout-change (execute): Splits a high-capacity physical port into multiple lower-capacity logical interfaces (e.g., splitting a 100G port into 4x25G ports).
portchannel (create, update, delete): Manages Link Aggregation Groups (LAG / PortChannels).
loopback (create, delete): Manages logical loopback interfaces and their IP addresses.
dhcp-relay (create, update, delete): Configures DHCP relay helpers for specific Network Segments.
configure-bgp / configure-routing-policy / configure-extended-mappings: Manages BGP peers, prefix lists, route maps, and external integrations (like NSX).

Configuration Management & Auditing

These modules ensure the network intent matches the actual device configurations.

reconciliation (execute): Starts the reconciliation workflow for given devices to compare intended configurations against actual states.
device-configuration-snapshot (pull-and-store, push, store): Backs up the running configuration from a device to the database, or restores a saved snapshot to a device.

Operations & Troubleshooting

These modules are used for diagnostics, monitoring, and software maintenance.

device-management-connectivity-check (execute): Verifies that the controller can successfully communicate with a device's management interface via gNMI/SSH.
cable-check (execute): Queries LLDP data on devices to verify if the physical cables match the intended topology defined in the DC Plan file.
devices-neighbors (pull): Extracts live neighbor (LLDP) data from devices to generate a DC Plan file automatically.
device-traffic (enable, disable): Safely drains traffic from a device (by manipulating BGP max-med and shutting down server-facing ports) or restores it.
find-server-by-ip-address / find-server-by-mac-address (execute): Scans Top of Rack (TOR) switch ARP, NDP, and MAC tables to locate the physical switchport a specific server is connected to.
os-image / os-upgrade (update, execute): Manages the repository of approved SONiC OS versions and executes the automated OS upgrade and reboot process across switches.
workflow-queue (see-all): Allows a user to view the execution status, logs, and outputs of all asynchronous tasks running in the system.
label-management-devices / label-management-interfaces (execute): Applies custom organizational tags (labels) to switches and ports for easier filtering and bulk operations.