Permissions

This page lists every permission key the current version of nexxus knows: 70 modules with 222 keys. The order is the one of the role editor under Access Roles: grouped by the areas of the main menu, and sorted by module key within each area. How roles, keys and pages work together is explained in Roles and rights.

Two rules apply to every key on this page. The system role ADMIN holds all of them. And roles add up: someone with several access roles holds the sum of their keys.

How a key is built

A key names a module and an action: project.project.read. Most modules have the same three standard keys:

Suffix	In the app (English)	In the app (German)	What it opens
.read	Read (management)	Lesen (Verwaltung)	The management view of the module: list, detail page, all fields. Where the module has a page of its own, this key opens it.
.apiRead	Pick (name only, no management)	Auswählen (nur Name, ohne Verwaltung)	Only id and name, for pickers and share dialogs. Does not open the management pages. Holders of .read can pick too.
.write	Write	Schreiben	Create, change and delete.

Some modules have extra keys, listed under each area. The most important one is .use, shown as Own records: it opens a person’s own data, while .read and .write open everyone’s.

Only two pages open without any key: the dashboard and My profile. A few pages are reserved for administrators whatever keys a role holds; the tables say so where it applies. The column “What it opens” describes .read; .write always adds creating, changing and deleting in the same module.

Where the labels come from

The role editor shows each key with its label and its technical key, and a tooltip with a short description. The tooltips come from the server and are partly in English, partly in German, whatever your interface language.

Start

Module (English)	Module (German)	Keys	What it opens
Reports	Auswertungen	core.analytics.read	Only .read: ask for figures, in the number tiles of the dashboard, the tile assistant and the AI Assistant’s report tools. Which numbers appear still depends on the read key of each data source.
Start page	Startseite	core.dashboard.manage	Only .manage, see below.
Apps	Apps	dmsApps.read dmsApps.apiRead dmsApps.write	The apps page and the apps in it.
Workspace (boards and tasks)	Workspace (Boards und Aufgaben)	workspaceItem.read workspaceItem.apiRead workspaceItem.write	The Workspace page with its boards and tasks, and the Desk. Which boards a person sees is decided by the sharing of each board.
Academy: courses	Academy: Kurse	academy.course.read academy.course.apiRead academy.course.write	The Academy page and the published courses. .write creates, changes and publishes courses and shows drafts and solutions.
Academy: learning	Academy: Lernen	academy.enrollment.read academy.enrollment.apiRead academy.enrollment.write	Your own progress, with .write also taking courses. Never reaches beyond your own progress.

Extra keys in this area:

Key	In the app (English)	In the app (German)	What it does
core.dashboard.manage	Manage	Verwalten	Set the dashboard that everyone sees who has not customised their own.

Organisation

Module (English)	Module (German)	Keys	What it opens
Calendar entries	Kalendereinträge	absence.calendarEntry.read absence.calendarEntry.apiRead absence.calendarEntry.write	Absences and special dates of employees, such as sickness, training or home office.
Public holidays	Feiertage	absence.holiday.read absence.holiday.apiRead absence.holiday.write	The Public holidays page.
Vacation quotas	Urlaubskontingente	absence.vacationQuota.read absence.vacationQuota.apiRead absence.vacationQuota.write	Vacation entitlement per employee and year.
Vacation requests	Urlaubsanträge	absence.vacationRequest.read absence.vacationRequest.apiRead absence.vacationRequest.write absence.vacationRequest.use	Everyone’s vacation requests. Own requests: .use, see below.
Invoices	Rechnungen	billing.invoice.read billing.invoice.apiRead billing.invoice.write	The Invoices page.
Invoice positions	Rechnungspositionen	billing.position.read billing.position.apiRead billing.position.write	The lines of invoices.
Contingents	Kontingente	contingent.agreement.read contingent.agreement.apiRead contingent.agreement.write	The Contingents page.
Credit accounts	Guthabenkonten	credit.account.read credit.account.apiRead credit.account.write	The Credit accounts page.
Credit bookings	Guthabenbuchungen	credit.transaction.read credit.transaction.apiRead credit.transaction.write	Bookings on credit accounts.
Billing roles	Abrechnungsrollen	organisation.billingRole.read organisation.billingRole.apiRead organisation.billingRole.write	The Billing roles page.
Branches	Niederlassungen	partner.branch.read partner.branch.apiRead partner.branch.write	Branches of customers, suppliers and own companies.
Contacts	Ansprechpartner	partner.contact.read partner.contact.apiRead partner.contact.write	Contact persons at customers and suppliers.
Partners	Partner	partner.partner.read partner.partner.apiRead partner.partner.write	The Customers, Suppliers and Own companies pages.
Projects	Projekte	project.project.read project.project.apiRead project.project.write	The Projects page.
Project assignments	Projektzuordnungen	project.projectAssignment.read project.projectAssignment.apiRead project.projectAssignment.write	Who works on which project.
Project groups	Projektgruppen	project.projectGroup.read project.projectGroup.apiRead project.projectGroup.write	Groups of projects.
Project links	Projektverweise	project.projectLink.read project.projectLink.apiRead project.projectLink.write	Links that belong to a project, such as its board, repository or demo environment.
Project rates	Projektsätze	project.projectRate.read project.projectRate.apiRead project.projectRate.write	Hourly rates per project.
Agreements	Vereinbarungen	timeAccount.agreement.read timeAccount.agreement.apiRead timeAccount.agreement.write	Arrangements that take precedence over the work schedule, such as a monthly overtime buyout or extra vacation.
Time account entries	Zeitkonto-Buchungen	timeAccount.transaction.read timeAccount.transaction.apiRead timeAccount.transaction.write	Manual bookings on an employee’s overtime account.
Time entries	Zeiteinträge	timesheet.entry.read timesheet.entry.apiRead timesheet.entry.write	Everyone’s individual time entries. Own entries come with timesheet.monthlyTimesheet.use.
Monthly timesheets	Stundennachweise	timesheet.monthlyTimesheet.read timesheet.monthlyTimesheet.apiRead timesheet.monthlyTimesheet.write timesheet.monthlyTimesheet.use	Every employee’s monthly timesheets, for HR and payroll. Own months: .use, see below.
Toggl sync	Toggl-Sync	timesheet.toggl.read timesheet.toggl.apiRead timesheet.toggl.write	Time entries synchronised from Toggl. The sync log page is for administrators only.

Extra keys in this area:

Key	In the app (English)	In the app (German)	What it does
absence.vacationRequest.use	Own records	Eigene Einträge	Request own leave, and open the Vacation requests page. A team lead decides on the requests of their team with the same key.
timesheet.monthlyTimesheet.use	Own records	Eigene Einträge	Keep and submit own monthly timesheets and entries, and open the Monthly timesheets page with one’s own months.

ISMS

Module (English)	Module (German)	Keys	What it opens
Assets	Werte	isms.asset.read isms.asset.apiRead isms.asset.write	The Assets page.
Self-declarations	Selbsterklärungen	isms.declaration.read isms.declaration.apiRead isms.declaration.write isms.declaration.use	Everyone’s self-declarations. Own declarations: .use, see below.
Declaration campaigns	Erklärungsrunden	isms.declarationCampaign.read isms.declarationCampaign.apiRead isms.declarationCampaign.write	The Declaration campaigns page.
Executions	Durchführungen	isms.execution.read isms.execution.apiRead isms.execution.write	Recorded executions of measures.
Security incidents	Sicherheitsvorfälle	isms.incident.read isms.incident.apiRead isms.incident.write isms.incident.report	All of the tenant’s security incidents with the assessment, reports to the authorities and the timeline, a right for the incident team. Reporting: .report, see below.
Measures	Maßnahmen	isms.measure.read isms.measure.apiRead isms.measure.write	The Measures page.
Compliance programmes	Compliance-Programme	isms.program.read isms.program.apiRead isms.program.write	The Compliance programmes page with the requirements per framework and the Statement of Applicability.
Risks	Risiken	isms.risk.read isms.risk.apiRead isms.risk.write	The Risks page.
Risk assessments	Risikobeurteilungen	isms.riskAssessment.read isms.riskAssessment.apiRead isms.riskAssessment.write	The Risk assessments page.
Risk method	Risikomethode	isms.riskMethod.read isms.riskMethod.apiRead isms.riskMethod.write	The Risk method page: levels, thresholds and their approval.

Extra keys in this area:

Key	In the app (English)	In the app (German)	What it does
isms.declaration.use	Own records	Eigene Einträge	Submit own self-declarations, and open the Self-declarations page.
isms.incident.report	Report	Melden	Report security incidents and see your own reports. Opens the Security incidents page, with your own reports only.

Documents

Module (English)	Module (German)	Keys	What it opens
Documents	Dokumente	dms.document.read dms.document.apiRead dms.document.write	.read opens the Files page. Which documents a person sees there is decided by the sharing of each document and folder.

AI

Module (English)	Module (German)	Keys	What it opens
AI connectors	KI-Connectoren	ai.plugin.read ai.plugin.use ai.plugin.connect ai.plugin.create ai.plugin.share ai.plugin.admin	Six keys of their own, see below.
AI Assistant	KI-Assistent	ai.session.use ai.session.create ai.knowledge.read ai.knowledge.write ai.tool.sql_query ai.tool.elasticsearch ai.tool.save_learning ai.tool.write_file ai.tool.bash	Keys of their own for chats, knowledge and the agent’s tools, see below.
AI Avatars	KI-Avatare	aiAssistant.agent.publish	Only .publish, see below.
AI Knowledge	KI-Wissen	aiAssistant.knowledgeItem.read aiAssistant.knowledgeItem.apiRead aiAssistant.knowledgeItem.write	Knowledge entries as records. The Knowledge page itself opens with ai.knowledge.read.
AI Providers	KI-Provider	aiAssistant.providerConfig.read aiAssistant.providerConfig.apiRead aiAssistant.providerConfig.write	The AI Providers page: connections to language models, keys and model lists.
Schedules	Schedules	aiAssistant.schedule.read aiAssistant.schedule.apiRead aiAssistant.schedule.write aiAssistant.schedule.writeTools aiAssistant.schedule.notifyOthers	.write manages the schedules of other people too. The Schedules page itself opens with ai.session.use, and everyone manages their own schedules there.
AI Skills	KI-Skills	aiAssistant.skill.read aiAssistant.skill.apiRead aiAssistant.skill.write	Skills as records. The Skills page opens with ai.session.use.
AI Tools	KI-Werkzeuge	aiAssistant.toolConfig.read aiAssistant.toolConfig.apiRead aiAssistant.toolConfig.write	Configuration of the assistant’s tools. .read also opens the connector settings with the network release.

Extra keys in this area:

Key	In the app (English)	In the app (German)	What it does
ai.plugin.read	Read (management)	Lesen (Verwaltung)	Open the Connectors page.
ai.plugin.use	Use	Benutzen	Use installed connectors in the chat.
ai.plugin.connect	Connect own account	Eigenes Konto verbinden	Connect one’s own account to a connector. Also shows the profile tab Connected accounts.
ai.plugin.create	Create	Anlegen	Create own MCP connectors, REST and OpenAPI connectors and skills.
ai.plugin.share	Share	Teilen	Share own connectors with people, roles, a business unit or the company.
ai.plugin.admin	Manage	Verwalten	Install and configure connectors, enter client IDs and secrets, set the network release, manage every connector.
ai.session.use	Open and use chats	Chats öffnen und benutzen	Open and use chats with the AI Assistant. Opens AI sessions, Avatars, Skills, Schedules and the Desk.
ai.session.create	Create new chats	Neue Chats anlegen	Start new chats.
ai.knowledge.read	Read knowledge	Wissen lesen	Read knowledge, and open the Knowledge page.
ai.knowledge.write	Edit knowledge	Wissen bearbeiten	Create, change and delete knowledge entries.
ai.tool.sql_query	SQL queries by the AI	SQL-Abfragen durch die KI	Tool of the agent runtime: SQL queries.
ai.tool.elasticsearch	Elasticsearch queries by the AI	Elasticsearch-Abfragen durch die KI	Tool of the agent runtime: Elasticsearch queries.
ai.tool.save_learning	AI may save knowledge	KI darf Wissen speichern	Tool of the agent runtime: save knowledge entries on the person’s behalf.
ai.tool.write_file	AI may create and edit files	KI darf Dateien anlegen und ändern	Tool of the agent runtime: create and edit files in the chat’s folder.
ai.tool.bash	AI may run shell commands	KI darf Shell-Befehle ausführen	Tool of the agent runtime: run shell commands.
aiAssistant.agent.publish	Publish	Freigeben	Publish avatars for a business unit or the whole company, and maintain them there.
aiAssistant.schedule.writeTools	Writing tools	Schreibende Werkzeuge	Set up schedules that use writing tools.
aiAssistant.schedule.notifyOthers	Notify further recipients	Weitere Empfänger benachrichtigen	Notify further recipients besides the responsible person.

The keys under ai.tool.* belong to the tools of the AI Assistant’s agent runtime. Tools that query the database directly are offered in the chat only to administrators, whatever keys a role holds.

Administration

This group also holds modules whose pages sit elsewhere in the menu, such as the forms: the editor files every module without a menu area of its own under Administration.

Module (English)	Module (German)	Keys	What it opens
Access Roles	Berechtigungsrollen	authentication.accessRole.read authentication.accessRole.apiRead authentication.accessRole.write authentication.accessRole.assign	.read opens the Access Roles page. Creating and deleting roles, changing a role’s permissions and assigning roles are reserved for administrators.
Business Units	Geschäftseinheiten	authentication.businessUnit.read authentication.businessUnit.apiRead authentication.businessUnit.write	The Business Units page. Creating a unit is reserved for administrators.
Impersonation	Impersonation	authentication.impersonation.read authentication.impersonation.apiRead authentication.impersonation.write authentication.impersonation.use authentication.impersonation.crossTenant	Impersonating needs the system role ADMIN or SUPERADMIN. These keys do not grant it on their own.
Tenants	Mandanten	authentication.tenant.read authentication.tenant.apiRead authentication.tenant.write	Tenant data. The Tenants page is for administrators only.
Users	Benutzer	authentication.user.read authentication.user.apiRead authentication.user.write	Full user data such as email and roles. .apiRead is enough to pick people by name, for example when sharing. The Users page is for administrators only.
User Access Roles	Benutzer-Berechtigungen	authentication.userAccessRoleAssignment.read authentication.userAccessRoleAssignment.apiRead authentication.userAccessRoleAssignment.write	Which person holds which access role. Assigning roles is reserved for administrators.
Emails	E-Mails	communication.email.read communication.email.apiRead communication.email.write communication.email.send	The Email delivery page with the mails nexxus sends. Writing new mails to any address: .send, see below.
System Mails	System-Mails	communication.systemMail.read communication.systemMail.apiRead communication.systemMail.write	The System Mails page.
Tags	Tags	communication.tag.read communication.tag.apiRead communication.tag.write	The Tags page.
Audit Log	Änderungsprotokoll	core.auditLog.read core.auditLog.apiRead core.auditLog.write	Entries of the audit log. The Audit Log page is for administrators only.
Application Logs	Anwendungs-Logs	core.logging.appLog.read core.logging.appLog.apiRead core.logging.appLog.write	Application logs. The page is for administrators only.
Cron Jobs	Cron-Jobs	core.logging.appLog.cronJob.read core.logging.appLog.cronJob.apiRead core.logging.appLog.cronJob.write	Scheduled jobs. The Cron Jobs page is for administrators only.
Event Logs	Ereignis-Logs	core.logging.eventLog.read core.logging.eventLog.apiRead core.logging.eventLog.write	Sign-in and event log entries. The Event logs page is for administrators only.
Migrations	Migrationen	core.migration.read core.migration.apiRead core.migration.write	Database migrations. The Migrations page needs the system role SUPERADMIN.
Text Blocks	Textbausteine	core.textBlock.read core.textBlock.apiRead core.textBlock.write	The Text Blocks page.
Forms	Formulare	formBuilder.read formBuilder.apiRead formBuilder.write	The Forms page.
Form categories	Formularkategorien	formBuilder.category.read formBuilder.category.apiRead formBuilder.category.write	The Categories page of the forms.
Field templates	Feldvorlagen	formBuilder.fieldTemplate.read formBuilder.fieldTemplate.apiRead formBuilder.fieldTemplate.write	The Field templates page.
Form records	Formulareinträge	formBuilder.record.read formBuilder.record.apiRead formBuilder.record.write	The Records page: filled-in forms.
Vector Viewer	Vektor-Viewer	llm.vectorViewer.read llm.vectorViewer.apiRead llm.vectorViewer.write	The Vector Viewer. The page is for administrators only.
Employee profiles	Mitarbeiterprofile	organisation.employeeProfile.read organisation.employeeProfile.apiRead organisation.employeeProfile.write	Employee profiles: team, billing role, time tracking (tab Employee of a user).
Skill levels	Stufen	organisation.skillLevel.read organisation.skillLevel.apiRead organisation.skillLevel.write	The levels of a billing role with their default rates (tab Levels).
Teams	Teams	organisation.team.read organisation.team.apiRead organisation.team.write	The Teams page.
Work schedules	Arbeitszeitmodelle	organisation.workSchedule.read organisation.workSchedule.apiRead organisation.workSchedule.write	The Work schedules page.
Work schedule assignments	Arbeitszeitzuordnungen	organisation.workScheduleAssignment.read organisation.workScheduleAssignment.apiRead organisation.workScheduleAssignment.write	Which work schedule applies to an employee from when (tab Employee of a user).
User profiles	Benutzerprofile	organisation.userProfile.read organisation.userProfile.apiRead organisation.userProfile.write	Which company and branch a person belongs to. Nobody can change their own.

Extra keys in this area:

Key	In the app (English)	In the app (German)	What it does
authentication.accessRole.assign	Assign	Zuweisen	Shown in the editor. Assigning roles is reserved for administrators.
authentication.impersonation.use	Impersonate	Impersonieren	Shown in the editor. Impersonating needs the system role ADMIN or SUPERADMIN.
authentication.impersonation.crossTenant	Impersonate (cross-tenant)	Impersonieren (Tenant-übergreifend)	Shown in the editor. Impersonating across tenants needs the system role SUPERADMIN.
communication.email.send	Send new e-mails (API)	Neue E-Mails senden (Schnittstelle)	Send new mails to any address through the GovStack messaging API. The sender is always the tenant’s address. Only administrators hold it until a role grants it.

Next steps

Roles and rightsHow roles, keys and pages work together.

GlossaryEvery term with its label in English and German.