# Permissions

> Every permission key in nexxus, grouped by area as in the role editor, with its label in English and German and what it opens.

This page lists every permission key the current version of nexxus knows: 70 modules with 222 keys. The order is the one of the role editor under **Access Roles**: grouped by the areas of the main menu, and sorted by module key within each area. How roles, keys and pages work together is explained in [Roles and rights](/setup/roles/).

Two rules apply to every key on this page. The system role **ADMIN** holds all of them. And **roles add up**: someone with several access roles holds the sum of their keys.

## How a key is built

A key names a module and an action: `project.project.read`. Most modules have the same three standard keys:

| Suffix | In the app (English) | In the app (German) | What it opens |
|---|---|---|---|
| `.read` | Read (management) | Lesen (Verwaltung) | The management view of the module: list, detail page, all fields. Where the module has a page of its own, this key opens it. |
| `.apiRead` | Pick (name only, no management) | Auswählen (nur Name, ohne Verwaltung) | Only id and name, for pickers and share dialogs. Does not open the management pages. Holders of `.read` can pick too. |
| `.write` | Write | Schreiben | Create, change and delete. |

Some modules have extra keys, listed under each area. The most important one is `.use`, shown as **Own records**: it opens a person's own data, while `.read` and `.write` open everyone's.

Only two pages open without any key: the dashboard and **My profile**. A few pages are reserved for administrators whatever keys a role holds; the tables say so where it applies. The column "What it opens" describes `.read`; `.write` always adds creating, changing and deleting in the same module.

:::note[Where the labels come from]
The role editor shows each key with its label and its technical key, and a tooltip with a short description. The tooltips come from the server and are partly in English, partly in German, whatever your interface language.
:::

## Start

| Module (English) | Module (German) | Keys | What it opens |
|---|---|---|---|
| Reports | Auswertungen | `core.analytics.read` | Only `.read`: ask for figures, in the number tiles of the dashboard, the tile assistant and the AI Assistant's report tools. Which numbers appear still depends on the read key of each data source. |
| Start page | Startseite | `core.dashboard.manage` | Only `.manage`, see below. |
| Apps | Apps | `dmsApps.read`<br />`dmsApps.apiRead`<br />`dmsApps.write` | The apps page and the apps in it. |
| Workspace (boards and tasks) | Workspace (Boards und Aufgaben) | `workspaceItem.read`<br />`workspaceItem.apiRead`<br />`workspaceItem.write` | The Workspace page with its boards and tasks, and the Desk. Which boards a person sees is decided by the sharing of each board. |
| Academy: courses | Academy: Kurse | `academy.course.read`<br />`academy.course.apiRead`<br />`academy.course.write` | The Academy page and the published courses. `.write` creates, changes and publishes courses and shows drafts and solutions. |
| Academy: learning | Academy: Lernen | `academy.enrollment.read`<br />`academy.enrollment.apiRead`<br />`academy.enrollment.write` | Your own progress, with `.write` also taking courses. Never reaches beyond your own progress. |

Extra keys in this area:

| Key | In the app (English) | In the app (German) | What it does |
|---|---|---|---|
| `core.dashboard.manage` | Manage | Verwalten | Set the dashboard that everyone sees who has not customised their own. |

## Organisation

| Module (English) | Module (German) | Keys | What it opens |
|---|---|---|---|
| Calendar entries | Kalendereinträge | `absence.calendarEntry.read`<br />`absence.calendarEntry.apiRead`<br />`absence.calendarEntry.write` | Absences and special dates of employees, such as sickness, training or home office. |
| Public holidays | Feiertage | `absence.holiday.read`<br />`absence.holiday.apiRead`<br />`absence.holiday.write` | The Public holidays page. |
| Vacation quotas | Urlaubskontingente | `absence.vacationQuota.read`<br />`absence.vacationQuota.apiRead`<br />`absence.vacationQuota.write` | Vacation entitlement per employee and year. |
| Vacation requests | Urlaubsanträge | `absence.vacationRequest.read`<br />`absence.vacationRequest.apiRead`<br />`absence.vacationRequest.write`<br />`absence.vacationRequest.use` | Everyone's vacation requests. Own requests: `.use`, see below. |
| Invoices | Rechnungen | `billing.invoice.read`<br />`billing.invoice.apiRead`<br />`billing.invoice.write` | The Invoices page. |
| Invoice positions | Rechnungspositionen | `billing.position.read`<br />`billing.position.apiRead`<br />`billing.position.write` | The lines of invoices. |
| Contingents | Kontingente | `contingent.agreement.read`<br />`contingent.agreement.apiRead`<br />`contingent.agreement.write` | The Contingents page. |
| Credit accounts | Guthabenkonten | `credit.account.read`<br />`credit.account.apiRead`<br />`credit.account.write` | The Credit accounts page. |
| Credit bookings | Guthabenbuchungen | `credit.transaction.read`<br />`credit.transaction.apiRead`<br />`credit.transaction.write` | Bookings on credit accounts. |
| Billing roles | Abrechnungsrollen | `organisation.billingRole.read`<br />`organisation.billingRole.apiRead`<br />`organisation.billingRole.write` | The Billing roles page. |
| Branches | Niederlassungen | `partner.branch.read`<br />`partner.branch.apiRead`<br />`partner.branch.write` | Branches of customers, suppliers and own companies. |
| Contacts | Ansprechpartner | `partner.contact.read`<br />`partner.contact.apiRead`<br />`partner.contact.write` | Contact persons at customers and suppliers. |
| Partners | Partner | `partner.partner.read`<br />`partner.partner.apiRead`<br />`partner.partner.write` | The Customers, Suppliers and Own companies pages. |
| Projects | Projekte | `project.project.read`<br />`project.project.apiRead`<br />`project.project.write` | The Projects page. |
| Project assignments | Projektzuordnungen | `project.projectAssignment.read`<br />`project.projectAssignment.apiRead`<br />`project.projectAssignment.write` | Who works on which project. |
| Project groups | Projektgruppen | `project.projectGroup.read`<br />`project.projectGroup.apiRead`<br />`project.projectGroup.write` | Groups of projects. |
| Project links | Projektverweise | `project.projectLink.read`<br />`project.projectLink.apiRead`<br />`project.projectLink.write` | Links that belong to a project, such as its board, repository or demo environment. |
| Project rates | Projektsätze | `project.projectRate.read`<br />`project.projectRate.apiRead`<br />`project.projectRate.write` | Hourly rates per project. |
| Agreements | Vereinbarungen | `timeAccount.agreement.read`<br />`timeAccount.agreement.apiRead`<br />`timeAccount.agreement.write` | Arrangements that take precedence over the work schedule, such as a monthly overtime buyout or extra vacation. |
| Time account entries | Zeitkonto-Buchungen | `timeAccount.transaction.read`<br />`timeAccount.transaction.apiRead`<br />`timeAccount.transaction.write` | Manual bookings on an employee's overtime account. |
| Time entries | Zeiteinträge | `timesheet.entry.read`<br />`timesheet.entry.apiRead`<br />`timesheet.entry.write` | Everyone's individual time entries. Own entries come with `timesheet.monthlyTimesheet.use`. |
| Monthly timesheets | Stundennachweise | `timesheet.monthlyTimesheet.read`<br />`timesheet.monthlyTimesheet.apiRead`<br />`timesheet.monthlyTimesheet.write`<br />`timesheet.monthlyTimesheet.use` | Every employee's monthly timesheets, for HR and payroll. Own months: `.use`, see below. |
| Toggl sync | Toggl-Sync | `timesheet.toggl.read`<br />`timesheet.toggl.apiRead`<br />`timesheet.toggl.write` | Time entries synchronised from Toggl. The sync log page is for administrators only. |

Extra keys in this area:

| Key | In the app (English) | In the app (German) | What it does |
|---|---|---|---|
| `absence.vacationRequest.use` | Own records | Eigene Einträge | Request own leave, and open the Vacation requests page. A team lead decides on the requests of their team with the same key. |
| `timesheet.monthlyTimesheet.use` | Own records | Eigene Einträge | Keep and submit own monthly timesheets and entries, and open the Monthly timesheets page with one's own months. |

## ISMS

| Module (English) | Module (German) | Keys | What it opens |
|---|---|---|---|
| Assets | Werte | `isms.asset.read`<br />`isms.asset.apiRead`<br />`isms.asset.write` | The Assets page. |
| Self-declarations | Selbsterklärungen | `isms.declaration.read`<br />`isms.declaration.apiRead`<br />`isms.declaration.write`<br />`isms.declaration.use` | Everyone's self-declarations. Own declarations: `.use`, see below. |
| Declaration campaigns | Erklärungsrunden | `isms.declarationCampaign.read`<br />`isms.declarationCampaign.apiRead`<br />`isms.declarationCampaign.write` | The Declaration campaigns page. |
| Executions | Durchführungen | `isms.execution.read`<br />`isms.execution.apiRead`<br />`isms.execution.write` | Recorded executions of measures. |
| Security incidents | Sicherheitsvorfälle | `isms.incident.read`<br />`isms.incident.apiRead`<br />`isms.incident.write`<br />`isms.incident.report` | All of the tenant's security incidents with the assessment, reports to the authorities and the timeline, a right for the incident team. Reporting: `.report`, see below. |
| Measures | Maßnahmen | `isms.measure.read`<br />`isms.measure.apiRead`<br />`isms.measure.write` | The Measures page. |
| Compliance programmes | Compliance-Programme | `isms.program.read`<br />`isms.program.apiRead`<br />`isms.program.write` | The Compliance programmes page with the requirements per framework and the Statement of Applicability. |
| Risks | Risiken | `isms.risk.read`<br />`isms.risk.apiRead`<br />`isms.risk.write` | The Risks page. |
| Risk assessments | Risikobeurteilungen | `isms.riskAssessment.read`<br />`isms.riskAssessment.apiRead`<br />`isms.riskAssessment.write` | The Risk assessments page. |
| Risk method | Risikomethode | `isms.riskMethod.read`<br />`isms.riskMethod.apiRead`<br />`isms.riskMethod.write` | The Risk method page: levels, thresholds and their approval. |

Extra keys in this area:

| Key | In the app (English) | In the app (German) | What it does |
|---|---|---|---|
| `isms.declaration.use` | Own records | Eigene Einträge | Submit own self-declarations, and open the Self-declarations page. |
| `isms.incident.report` | Report | Melden | Report security incidents and see your own reports. Opens the Security incidents page, with your own reports only. |

## Documents

| Module (English) | Module (German) | Keys | What it opens |
|---|---|---|---|
| Documents | Dokumente | `dms.document.read`<br />`dms.document.apiRead`<br />`dms.document.write` | `.read` opens the Files page. Which documents a person sees there is decided by the sharing of each document and folder. |

## AI

| Module (English) | Module (German) | Keys | What it opens |
|---|---|---|---|
| AI connectors | KI-Connectoren | `ai.plugin.read`<br />`ai.plugin.use`<br />`ai.plugin.connect`<br />`ai.plugin.create`<br />`ai.plugin.share`<br />`ai.plugin.admin` | Six keys of their own, see below. |
| AI Assistant | KI-Assistent | `ai.session.use`<br />`ai.session.create`<br />`ai.knowledge.read`<br />`ai.knowledge.write`<br />`ai.tool.sql_query`<br />`ai.tool.elasticsearch`<br />`ai.tool.save_learning`<br />`ai.tool.write_file`<br />`ai.tool.bash` | Keys of their own for chats, knowledge and the agent's tools, see below. |
| AI Avatars | KI-Avatare | `aiAssistant.agent.publish` | Only `.publish`, see below. |
| AI Knowledge | KI-Wissen | `aiAssistant.knowledgeItem.read`<br />`aiAssistant.knowledgeItem.apiRead`<br />`aiAssistant.knowledgeItem.write` | Knowledge entries as records. The Knowledge page itself opens with `ai.knowledge.read`. |
| AI Providers | KI-Provider | `aiAssistant.providerConfig.read`<br />`aiAssistant.providerConfig.apiRead`<br />`aiAssistant.providerConfig.write` | The AI Providers page: connections to language models, keys and model lists. |
| Schedules | Schedules | `aiAssistant.schedule.read`<br />`aiAssistant.schedule.apiRead`<br />`aiAssistant.schedule.write`<br />`aiAssistant.schedule.writeTools`<br />`aiAssistant.schedule.notifyOthers` | `.write` manages the schedules of other people too. The Schedules page itself opens with `ai.session.use`, and everyone manages their own schedules there. |
| AI Skills | KI-Skills | `aiAssistant.skill.read`<br />`aiAssistant.skill.apiRead`<br />`aiAssistant.skill.write` | Skills as records. The Skills page opens with `ai.session.use`. |
| AI Tools | KI-Werkzeuge | `aiAssistant.toolConfig.read`<br />`aiAssistant.toolConfig.apiRead`<br />`aiAssistant.toolConfig.write` | Configuration of the assistant's tools. `.read` also opens the connector settings with the network release. |

Extra keys in this area:

| Key | In the app (English) | In the app (German) | What it does |
|---|---|---|---|
| `ai.plugin.read` | Read (management) | Lesen (Verwaltung) | Open the Connectors page. |
| `ai.plugin.use` | Use | Benutzen | Use installed connectors in the chat. |
| `ai.plugin.connect` | Connect own account | Eigenes Konto verbinden | Connect one's own account to a connector. Also shows the profile tab Connected accounts. |
| `ai.plugin.create` | Create | Anlegen | Create own MCP connectors, REST and OpenAPI connectors and skills. |
| `ai.plugin.share` | Share | Teilen | Share own connectors with people, roles, a business unit or the company. |
| `ai.plugin.admin` | Manage | Verwalten | Install and configure connectors, enter client IDs and secrets, set the network release, manage every connector. |
| `ai.session.use` | Open and use chats | Chats öffnen und benutzen | Open and use chats with the AI Assistant. Opens AI sessions, Avatars, Skills, Schedules and the Desk. |
| `ai.session.create` | Create new chats | Neue Chats anlegen | Start new chats. |
| `ai.knowledge.read` | Read knowledge | Wissen lesen | Read knowledge, and open the Knowledge page. |
| `ai.knowledge.write` | Edit knowledge | Wissen bearbeiten | Create, change and delete knowledge entries. |
| `ai.tool.sql_query` | SQL queries by the AI | SQL-Abfragen durch die KI | Tool of the agent runtime: SQL queries. |
| `ai.tool.elasticsearch` | Elasticsearch queries by the AI | Elasticsearch-Abfragen durch die KI | Tool of the agent runtime: Elasticsearch queries. |
| `ai.tool.save_learning` | AI may save knowledge | KI darf Wissen speichern | Tool of the agent runtime: save knowledge entries on the person's behalf. |
| `ai.tool.write_file` | AI may create and edit files | KI darf Dateien anlegen und ändern | Tool of the agent runtime: create and edit files in the chat's folder. |
| `ai.tool.bash` | AI may run shell commands | KI darf Shell-Befehle ausführen | Tool of the agent runtime: run shell commands. |
| `aiAssistant.agent.publish` | Publish | Freigeben | Publish avatars for a business unit or the whole company, and maintain them there. |
| `aiAssistant.schedule.writeTools` | Writing tools | Schreibende Werkzeuge | Set up schedules that use writing tools. |
| `aiAssistant.schedule.notifyOthers` | Notify further recipients | Weitere Empfänger benachrichtigen | Notify further recipients besides the responsible person. |

The keys under `ai.tool.*` belong to the tools of the AI Assistant's agent runtime. Tools that query the database directly are offered in the chat only to administrators, whatever keys a role holds.

## Administration

This group also holds modules whose pages sit elsewhere in the menu, such as the forms: the editor files every module without a menu area of its own under Administration.

| Module (English) | Module (German) | Keys | What it opens |
|---|---|---|---|
| Access Roles | Berechtigungsrollen | `authentication.accessRole.read`<br />`authentication.accessRole.apiRead`<br />`authentication.accessRole.write`<br />`authentication.accessRole.assign` | `.read` opens the Access Roles page. Creating and deleting roles, changing a role's permissions and assigning roles are reserved for administrators. |
| Business Units | Geschäftseinheiten | `authentication.businessUnit.read`<br />`authentication.businessUnit.apiRead`<br />`authentication.businessUnit.write` | The Business Units page. Creating a unit is reserved for administrators. |
| Impersonation | Impersonation | `authentication.impersonation.read`<br />`authentication.impersonation.apiRead`<br />`authentication.impersonation.write`<br />`authentication.impersonation.use`<br />`authentication.impersonation.crossTenant` | Impersonating needs the system role ADMIN or SUPERADMIN. These keys do not grant it on their own. |
| Tenants | Mandanten | `authentication.tenant.read`<br />`authentication.tenant.apiRead`<br />`authentication.tenant.write` | Tenant data. The Tenants page is for administrators only. |
| Users | Benutzer | `authentication.user.read`<br />`authentication.user.apiRead`<br />`authentication.user.write` | Full user data such as email and roles. `.apiRead` is enough to pick people by name, for example when sharing. The Users page is for administrators only. |
| User Access Roles | Benutzer-Berechtigungen | `authentication.userAccessRoleAssignment.read`<br />`authentication.userAccessRoleAssignment.apiRead`<br />`authentication.userAccessRoleAssignment.write` | Which person holds which access role. Assigning roles is reserved for administrators. |
| Emails | E-Mails | `communication.email.read`<br />`communication.email.apiRead`<br />`communication.email.write`<br />`communication.email.send` | The Email delivery page with the mails nexxus sends. Writing new mails to any address: `.send`, see below. |
| System Mails | System-Mails | `communication.systemMail.read`<br />`communication.systemMail.apiRead`<br />`communication.systemMail.write` | The System Mails page. |
| Tags | Tags | `communication.tag.read`<br />`communication.tag.apiRead`<br />`communication.tag.write` | The Tags page. |
| Audit Log | Änderungsprotokoll | `core.auditLog.read`<br />`core.auditLog.apiRead`<br />`core.auditLog.write` | Entries of the audit log. The Audit Log page is for administrators only. |
| Application Logs | Anwendungs-Logs | `core.logging.appLog.read`<br />`core.logging.appLog.apiRead`<br />`core.logging.appLog.write` | Application logs. The page is for administrators only. |
| Cron Jobs | Cron-Jobs | `core.logging.appLog.cronJob.read`<br />`core.logging.appLog.cronJob.apiRead`<br />`core.logging.appLog.cronJob.write` | Scheduled jobs. The Cron Jobs page is for administrators only. |
| Event Logs | Ereignis-Logs | `core.logging.eventLog.read`<br />`core.logging.eventLog.apiRead`<br />`core.logging.eventLog.write` | Sign-in and event log entries. The Event logs page is for administrators only. |
| Migrations | Migrationen | `core.migration.read`<br />`core.migration.apiRead`<br />`core.migration.write` | Database migrations. The Migrations page needs the system role SUPERADMIN. |
| Text Blocks | Textbausteine | `core.textBlock.read`<br />`core.textBlock.apiRead`<br />`core.textBlock.write` | The Text Blocks page. |
| Forms | Formulare | `formBuilder.read`<br />`formBuilder.apiRead`<br />`formBuilder.write` | The Forms page. |
| Form categories | Formularkategorien | `formBuilder.category.read`<br />`formBuilder.category.apiRead`<br />`formBuilder.category.write` | The Categories page of the forms. |
| Field templates | Feldvorlagen | `formBuilder.fieldTemplate.read`<br />`formBuilder.fieldTemplate.apiRead`<br />`formBuilder.fieldTemplate.write` | The Field templates page. |
| Form records | Formulareinträge | `formBuilder.record.read`<br />`formBuilder.record.apiRead`<br />`formBuilder.record.write` | The Records page: filled-in forms. |
| Vector Viewer | Vektor-Viewer | `llm.vectorViewer.read`<br />`llm.vectorViewer.apiRead`<br />`llm.vectorViewer.write` | The Vector Viewer. The page is for administrators only. |
| Employee profiles | Mitarbeiterprofile | `organisation.employeeProfile.read`<br />`organisation.employeeProfile.apiRead`<br />`organisation.employeeProfile.write` | Employee profiles: team, billing role, time tracking (tab Employee of a user). |
| Skill levels | Stufen | `organisation.skillLevel.read`<br />`organisation.skillLevel.apiRead`<br />`organisation.skillLevel.write` | The levels of a billing role with their default rates (tab Levels). |
| Teams | Teams | `organisation.team.read`<br />`organisation.team.apiRead`<br />`organisation.team.write` | The Teams page. |
| Work schedules | Arbeitszeitmodelle | `organisation.workSchedule.read`<br />`organisation.workSchedule.apiRead`<br />`organisation.workSchedule.write` | The Work schedules page. |
| Work schedule assignments | Arbeitszeitzuordnungen | `organisation.workScheduleAssignment.read`<br />`organisation.workScheduleAssignment.apiRead`<br />`organisation.workScheduleAssignment.write` | Which work schedule applies to an employee from when (tab Employee of a user). |
| User profiles | Benutzerprofile | `organisation.userProfile.read`<br />`organisation.userProfile.apiRead`<br />`organisation.userProfile.write` | Which company and branch a person belongs to. Nobody can change their own. |

Extra keys in this area:

| Key | In the app (English) | In the app (German) | What it does |
|---|---|---|---|
| `authentication.accessRole.assign` | Assign | Zuweisen | Shown in the editor. Assigning roles is reserved for administrators. |
| `authentication.impersonation.use` | Impersonate | Impersonieren | Shown in the editor. Impersonating needs the system role ADMIN or SUPERADMIN. |
| `authentication.impersonation.crossTenant` | Impersonate (cross-tenant) | Impersonieren (Tenant-übergreifend) | Shown in the editor. Impersonating across tenants needs the system role SUPERADMIN. |
| `communication.email.send` | Send new e-mails (API) | Neue E-Mails senden (Schnittstelle) | Send new mails to any address through the [GovStack messaging API](/reference/govstack/#messaging). The sender is always the tenant's address. Only administrators hold it until a role grants it. |

## Next steps

<CardGrid>
  <LinkCard title="Roles and rights" description="How roles, keys and pages work together." href="/setup/roles/" />
  <LinkCard title="Glossary" description="Every term with its label in English and German." href="/reference/glossary/" />
</CardGrid>