Capabilities

In Splunk Agent Observability, capability-based access tokens and collaborator roles determine the actions that a user can perform on a resource. For an action to be allowed, both of these conditions must be met:

The access token contains the matching capability.
The user has the required collaborator role for the resource.

This page describes capability-based access control and the available capability keys.

Collaborator roles

Collaborator roles don’t apply to global evaluators or groups. Group access is based on group membership or visibility.

When a resource is shared with a user in the UI, the user is granted a collaborator role that sets a resource-level ceiling on the actions they can perform. The user’s access token must still contain the required capability for them to perform a given action. The following table describes resource access by collaborator role:

Resource	Owner	Editor	Annotator	Viewer
Projects	Manage the project, including sharing.	Work with runs, data, annotations, Agent Streams, evaluator settings, and controls.	View the project and record human feedback.	View the project.
Datasets	Manage, share, and delete the dataset.	Update, rename, and export the dataset.	Not offered.	View the dataset.
Prompts	Manage, share, and delete the prompt.	Update the prompt.	Not offered.	View the prompt.
Annotation queues	Manage, share, and annotate the queue.	Not offered.	View the queue and record annotations.	Not offered.
LLM integrations	Creator only: Manage the integration and view its credentials.	Not offered.	Not offered.	View the integration.
Project-scoped evaluators	Manage evaluators scoped to the project.	Manage evaluators scoped to the project.	View evaluators scoped to the project.	View evaluators scoped to the project.

Capability types

Capabilities can be one of the following types:

SHARED actions apply to a shared resource. For example, a project used by multiple people. SHARED isn’t a blanket permission. It doesn’t add you as a collaborator or elevate your role.
ALL actions apply across the organization.
GLOBAL actions only apply to evaluators, which don’t use collaborator roles.

Capability keys

Annotation queues

Capability	What it enables
`o11y_create_annotation_queue`	Create annotation queues.
`o11y_read_annotation_queue_shared`	View annotation queues where you are a collaborator.
`o11y_update_annotation_queue_shared`	Update annotation queues where you are an Owner or Editor.
`o11y_delete_annotation_queue_shared`	Delete annotation queues where you are an Owner.
`o11y_share_annotation_queue_shared`	Share annotation queues where you are an Owner.
`o11y_record_annotation_annotation_queue_shared`	Record annotations in queues where you are an Owner, Editor, or Annotator.
`o11y_read_annotation_queue_all`	View all annotation queues in the organization.
`o11y_update_annotation_queue_all`	Update any annotation queue in the organization.
`o11y_delete_annotation_queue_all`	Delete any annotation queue in the organization.
`o11y_share_annotation_queue_all`	Share any annotation queue in the organization.

Projects

Capability	What it enables
`o11y_create_project`	Create projects.
`o11y_read_project_shared`	View projects where you are a collaborator.
`o11y_delete_project_shared`	Delete projects where you are an Owner.
`o11y_share_project_shared`	Share projects where you are an Owner.
`o11y_rename_project_shared`	Rename projects where you are an Owner.
`o11y_create_run_project_shared`	Create runs in projects where you are an Owner or Editor.
`o11y_delete_run_project_shared`	Delete runs in projects where you are an Owner.
`o11y_rename_run_project_shared`	Rename runs in projects where you are an Owner or Editor.
`o11y_export_data_project_shared`	Export data from projects where you are an Owner or Editor.
`o11y_configure_annotations_project_shared`	Configure annotations for projects where you are an Owner or Editor.
`o11y_record_annotations_project_shared`	Record annotations in projects where you are an Owner, Editor, or Annotator.
`o11y_log_data_project_shared`	Send Agent Stream data to projects where you are an Owner or Editor.
`o11y_toggle_evaluator_project_shared`	Enable or disable evaluators for projects where you are an Owner.
`o11y_edit_alert_project_shared`	Edit alerts for projects where you are an Owner.
`o11y_edit_ranking_project_shared`	Edit rankings for projects where you are an Owner.
`o11y_delete_data_project_shared`	Delete data from projects where you are an Owner.
`o11y_set_evaluator_project_shared`	Assign evaluators to projects where you are an Owner or Editor.
`o11y_edit_run_tags_project_shared`	Edit run tags in projects where you are an Owner or Editor.
`o11y_update_control_bindings_project_shared`	Update agent-control bindings for projects where you are an Owner or Editor.
`o11y_use_control_runtime_project_shared`	Run agent controls in projects where you are an Owner or Editor.
`o11y_read_project_all`	View all projects in the organization.
`o11y_delete_project_all`	Delete any project in the organization.
`o11y_share_project_all`	Share any project in the organization.

Datasets

Capability	What it enables
`o11y_create_dataset`	Create datasets.
`o11y_read_dataset_shared`	View datasets where you are a collaborator.
`o11y_update_dataset_shared`	Update datasets where you are an Owner or Editor.
`o11y_share_dataset_shared`	Share datasets where you are an Owner.
`o11y_delete_dataset_shared`	Delete datasets where you are an Owner.
`o11y_rename_dataset_shared`	Rename datasets where you are an Owner or Editor.
`o11y_export_dataset_shared`	Export datasets where you are an Owner or Editor.
`o11y_read_dataset_all`	View all datasets in the organization.
`o11y_update_dataset_all`	Update any dataset in the organization.
`o11y_share_dataset_all`	Share any dataset in the organization.
`o11y_delete_dataset_all`	Delete any dataset in the organization.

Prompts

Capability	What it enables
`o11y_create_prompt`	Create prompts.
`o11y_read_prompt_shared`	View prompts where you are a collaborator.
`o11y_update_prompt_shared`	Update prompts where you are an Owner or Editor.
`o11y_share_prompt_shared`	Share prompts where you are an Owner.
`o11y_delete_prompt_shared`	Delete prompts where you are an Owner.
`o11y_read_prompt_all`	View all prompts in the organization.
`o11y_update_prompt_all`	Update any prompt in the organization.
`o11y_share_prompt_all`	Share any prompt in the organization.
`o11y_delete_prompt_all`	Delete any prompt in the organization.

LLM integrations

Capability	What it enables
`o11y_create_llm_integration`	Add LLM integrations.
`o11y_read_llm_integration_shared`	View LLM integrations where you are a collaborator.
`o11y_update_llm_integration_shared`	Update LLM integrations where you are an Owner.
`o11y_share_llm_integration_shared`	Share LLM integrations where you are an Owner.
`o11y_delete_llm_integration_shared`	Delete LLM integrations where you are an Owner.
`o11y_read_secrets_llm_integration_shared`	View credentials for LLM integrations you created.
`o11y_read_llm_integration_all`	View all LLM integrations in the organization.
`o11y_update_llm_integration_all`	Update any LLM integration in the organization.
`o11y_share_llm_integration_all`	Share any LLM integration in the organization.
`o11y_delete_llm_integration_all`	Delete any LLM integration in the organization.
`o11y_read_secrets_llm_integration_all`	View credentials for any LLM integration in the organization.

Evaluators

Capability	What it enables
`o11y_create_evaluator_shared`	Create a project-scoped evaluator for a project you can access.
`o11y_create_evaluator_global`	Create evaluators available across projects.
`o11y_read_evaluator_shared`	View project-scoped evaluators where you are a collaborator.
`o11y_read_evaluator_global`	View evaluators available across projects.
`o11y_read_evaluator_all`	View all evaluators in the organization.
`o11y_update_evaluator_shared`	Update project-scoped evaluators where you are an Owner or Editor.
`o11y_delete_evaluator_shared`	Delete project-scoped evaluators where you are an Owner or Editor.
`o11y_export_evaluator_shared`	Export project-scoped evaluators where you are an Owner or Editor.
`o11y_autotune_apply_evaluator_shared`	Apply auto-tuning to project-scoped evaluators where you are an Owner or Editor.
`o11y_share_evaluator_shared`	Share project-scoped evaluators where you are an Owner or Editor.
`o11y_update_evaluator_all`	Update any evaluator in the organization.
`o11y_delete_evaluator_all`	Delete any evaluator in the organization.
`o11y_export_evaluator_all`	Export any evaluator in the organization.
`o11y_autotune_apply_evaluator_all`	Apply evaluator auto-tuning to any evaluator in the organization.
`o11y_share_evaluator_all`	Share any evaluator in the organization.

Groups

Capability	What it enables
`o11y_read_group_shared`	View public or private groups, or groups where you are a member.
`o11y_read_group_all`	View all groups in the organization.

Agent controls

Capability	What it enables
`o11y_read_control`	View agent controls.
`o11y_create_control`	Create agent controls.
`o11y_update_control`	Update agent controls.
`o11y_delete_control`	Delete agent controls.

Custom dashboards

Capability	What it enables
`o11y_read_custom_dashboard`	View custom dashboards.
`o11y_create_custom_dashboard`	Create custom dashboards.
`o11y_update_custom_dashboard`	Update custom dashboards.
`o11y_delete_custom_dashboard`	Delete custom dashboards.

Provider-management API integrations

Capability	What it enables
`o11y_create_provider_management_api_integration`	Add provider analytics connections for Tokenomics.
`o11y_read_provider_management_api_integration`	View provider analytics connections used by Tokenomics.
`o11y_update_provider_management_api_integration`	Update provider analytics connections used by Tokenomics.
`o11y_delete_provider_management_api_integration`	Remove provider analytics connections used by Tokenomics.

Organization settings

Capability	What it enables
`o11y_read_cost_settings_organization`	View organization cost settings.
`o11y_read_ai_usage_organization`	View AI usage for the organization.
`o11y_delete_log_data_organization`	Delete organization Agent Stream data.
`o11y_read_settings_organization`	View organization settings.
`o11y_update_settings_organization`	Update organization settings.
`o11y_read_ai_usage_aggregate_organization`	View aggregate AI usage for the organization.
`o11y_read_unredacted_data_organization`	View unredacted traces and annotation data.

Users

Capability	What it enables
`o11y_read_user_all`	View all users in the organization.

Overview

SaaS deployments

Get Started

Observability

Evaluators

Tokenomics

Signals

AI Assistant

Luna Studio

Experiments

Agent Control

Annotations

Integrations

Security

References

Collaborator roles

Capability types

Capability keys

Annotation queues

Projects

Datasets

Prompts

LLM integrations

Evaluators

Groups

Agent controls

Custom dashboards

Provider-management API integrations

Organization settings

Users

Roles in Splunk Observability Cloud

​Collaborator roles

​Capability types

​Capability keys

​Annotation queues

​Projects

​Datasets

​Prompts

​LLM integrations

​Evaluators

​Groups

​Agent controls

​Custom dashboards

​Provider-management API integrations

​Organization settings

​Users

​Related resources

Roles in Splunk Observability Cloud

Collaborator roles

Capability types

Capability keys

Annotation queues

Projects

Datasets

Prompts

LLM integrations

Evaluators

Groups

Agent controls

Custom dashboards

Provider-management API integrations

Organization settings

Users

Related resources