> ## Documentation Index
> Fetch the complete documentation index at: https://agent-observability-docs.splunk.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Capabilities
> Learn about capability-based access control for SaaS deployments
In Splunk Agent Observability, capability-based access tokens and collaborator roles determine the actions that a user can perform on a resource.
For an action to be allowed, both of these conditions must be met:
1. The access token contains the matching capability.
2. The user has the required collaborator role for the resource.
This page describes capability-based access control and the available capability keys.
## Collaborator roles
Collaborator roles don't apply to global evaluators or groups. Group access is based on group membership or visibility.
When a resource is shared with a user in the UI, the user is granted a collaborator role that sets a resource-level ceiling on the actions they can perform. The user's access token must still contain the required capability for them to perform a given action.
The following table describes resource access by collaborator role:
| Resource | Owner | Editor | Annotator | Viewer |
| ------------------------- | -------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------- | -------------------------------------- |
| Projects | Manage the project, including sharing. | Work with runs, data, annotations, Agent Streams, evaluator settings, and controls. | View the project and record human feedback. | View the project. |
| Datasets | Manage, share, and delete the dataset. | Update, rename, and export the dataset. | Not offered. | View the dataset. |
| Prompts | Manage, share, and delete the prompt. | Update the prompt. | Not offered. | View the prompt. |
| Annotation queues | Manage, share, and annotate the queue. | Not offered. | View the queue and record annotations. | Not offered. |
| LLM integrations | Creator only: Manage the integration and view its credentials. | Not offered. | Not offered. | View the integration. |
| Project-scoped evaluators | Manage evaluators scoped to the project. | Manage evaluators scoped to the project. | View evaluators scoped to the project. | View evaluators scoped to the project. |
## Capability types
Capabilities can be one of the following types:
* `SHARED` actions apply to a shared resource. For example, a project used by multiple people. `SHARED` isn't a blanket permission. It doesn't add you as a collaborator or elevate your role.
* `ALL` actions apply across the organization.
* `GLOBAL` actions only apply to evaluators, which don't use collaborator roles.
## Capability keys
### Annotation queues
| Capability | What it enables |
| ------------------------------------------------ | -------------------------------------------------------------------------- |
| `o11y_create_annotation_queue` | Create annotation queues. |
| `o11y_read_annotation_queue_shared` | View annotation queues where you are a collaborator. |
| `o11y_update_annotation_queue_shared` | Update annotation queues where you are an Owner or Editor. |
| `o11y_delete_annotation_queue_shared` | Delete annotation queues where you are an Owner. |
| `o11y_share_annotation_queue_shared` | Share annotation queues where you are an Owner. |
| `o11y_record_annotation_annotation_queue_shared` | Record annotations in queues where you are an Owner, Editor, or Annotator. |
| `o11y_read_annotation_queue_all` | View all annotation queues in the organization. |
| `o11y_update_annotation_queue_all` | Update any annotation queue in the organization. |
| `o11y_delete_annotation_queue_all` | Delete any annotation queue in the organization. |
| `o11y_share_annotation_queue_all` | Share any annotation queue in the organization. |
### Projects
| Capability | What it enables |
| --------------------------------------------- | ---------------------------------------------------------------------------- |
| `o11y_create_project` | Create projects. |
| `o11y_read_project_shared` | View projects where you are a collaborator. |
| `o11y_delete_project_shared` | Delete projects where you are an Owner. |
| `o11y_share_project_shared` | Share projects where you are an Owner. |
| `o11y_rename_project_shared` | Rename projects where you are an Owner. |
| `o11y_create_run_project_shared` | Create runs in projects where you are an Owner or Editor. |
| `o11y_delete_run_project_shared` | Delete runs in projects where you are an Owner. |
| `o11y_rename_run_project_shared` | Rename runs in projects where you are an Owner or Editor. |
| `o11y_export_data_project_shared` | Export data from projects where you are an Owner or Editor. |
| `o11y_configure_annotations_project_shared` | Configure annotations for projects where you are an Owner or Editor. |
| `o11y_record_annotations_project_shared` | Record annotations in projects where you are an Owner, Editor, or Annotator. |
| `o11y_log_data_project_shared` | Send Agent Stream data to projects where you are an Owner or Editor. |
| `o11y_toggle_evaluator_project_shared` | Enable or disable evaluators for projects where you are an Owner. |
| `o11y_edit_alert_project_shared` | Edit alerts for projects where you are an Owner. |
| `o11y_edit_ranking_project_shared` | Edit rankings for projects where you are an Owner. |
| `o11y_delete_data_project_shared` | Delete data from projects where you are an Owner. |
| `o11y_set_evaluator_project_shared` | Assign evaluators to projects where you are an Owner or Editor. |
| `o11y_edit_run_tags_project_shared` | Edit run tags in projects where you are an Owner or Editor. |
| `o11y_update_control_bindings_project_shared` | Update agent-control bindings for projects where you are an Owner or Editor. |
| `o11y_use_control_runtime_project_shared` | Run agent controls in projects where you are an Owner or Editor. |
| `o11y_read_project_all` | View all projects in the organization. |
| `o11y_delete_project_all` | Delete any project in the organization. |
| `o11y_share_project_all` | Share any project in the organization. |
### Datasets
| Capability | What it enables |
| ---------------------------- | ------------------------------------------------- |
| `o11y_create_dataset` | Create datasets. |
| `o11y_read_dataset_shared` | View datasets where you are a collaborator. |
| `o11y_update_dataset_shared` | Update datasets where you are an Owner or Editor. |
| `o11y_share_dataset_shared` | Share datasets where you are an Owner. |
| `o11y_delete_dataset_shared` | Delete datasets where you are an Owner. |
| `o11y_rename_dataset_shared` | Rename datasets where you are an Owner or Editor. |
| `o11y_export_dataset_shared` | Export datasets where you are an Owner or Editor. |
| `o11y_read_dataset_all` | View all datasets in the organization. |
| `o11y_update_dataset_all` | Update any dataset in the organization. |
| `o11y_share_dataset_all` | Share any dataset in the organization. |
| `o11y_delete_dataset_all` | Delete any dataset in the organization. |
### Prompts
| Capability | What it enables |
| --------------------------- | ------------------------------------------------ |
| `o11y_create_prompt` | Create prompts. |
| `o11y_read_prompt_shared` | View prompts where you are a collaborator. |
| `o11y_update_prompt_shared` | Update prompts where you are an Owner or Editor. |
| `o11y_share_prompt_shared` | Share prompts where you are an Owner. |
| `o11y_delete_prompt_shared` | Delete prompts where you are an Owner. |
| `o11y_read_prompt_all` | View all prompts in the organization. |
| `o11y_update_prompt_all` | Update any prompt in the organization. |
| `o11y_share_prompt_all` | Share any prompt in the organization. |
| `o11y_delete_prompt_all` | Delete any prompt in the organization. |
### LLM integrations
| Capability | What it enables |
| ------------------------------------------ | ------------------------------------------------------------- |
| `o11y_create_llm_integration` | Add LLM integrations. |
| `o11y_read_llm_integration_shared` | View LLM integrations where you are a collaborator. |
| `o11y_update_llm_integration_shared` | Update LLM integrations where you are an Owner. |
| `o11y_share_llm_integration_shared` | Share LLM integrations where you are an Owner. |
| `o11y_delete_llm_integration_shared` | Delete LLM integrations where you are an Owner. |
| `o11y_read_secrets_llm_integration_shared` | View credentials for LLM integrations you created. |
| `o11y_read_llm_integration_all` | View all LLM integrations in the organization. |
| `o11y_update_llm_integration_all` | Update any LLM integration in the organization. |
| `o11y_share_llm_integration_all` | Share any LLM integration in the organization. |
| `o11y_delete_llm_integration_all` | Delete any LLM integration in the organization. |
| `o11y_read_secrets_llm_integration_all` | View credentials for any LLM integration in the organization. |
### Evaluators
| Capability | What it enables |
| -------------------------------------- | -------------------------------------------------------------------------------- |
| `o11y_create_evaluator_shared` | Create a project-scoped evaluator for a project you can access. |
| `o11y_create_evaluator_global` | Create evaluators available across projects. |
| `o11y_read_evaluator_shared` | View project-scoped evaluators where you are a collaborator. |
| `o11y_read_evaluator_global` | View evaluators available across projects. |
| `o11y_read_evaluator_all` | View all evaluators in the organization. |
| `o11y_update_evaluator_shared` | Update project-scoped evaluators where you are an Owner or Editor. |
| `o11y_delete_evaluator_shared` | Delete project-scoped evaluators where you are an Owner or Editor. |
| `o11y_export_evaluator_shared` | Export project-scoped evaluators where you are an Owner or Editor. |
| `o11y_autotune_apply_evaluator_shared` | Apply auto-tuning to project-scoped evaluators where you are an Owner or Editor. |
| `o11y_share_evaluator_shared` | Share project-scoped evaluators where you are an Owner or Editor. |
| `o11y_update_evaluator_all` | Update any evaluator in the organization. |
| `o11y_delete_evaluator_all` | Delete any evaluator in the organization. |
| `o11y_export_evaluator_all` | Export any evaluator in the organization. |
| `o11y_autotune_apply_evaluator_all` | Apply evaluator auto-tuning to any evaluator in the organization. |
| `o11y_share_evaluator_all` | Share any evaluator in the organization. |
### Groups
| Capability | What it enables |
| ------------------------ | ---------------------------------------------------------------- |
| `o11y_read_group_shared` | View public or private groups, or groups where you are a member. |
| `o11y_read_group_all` | View all groups in the organization. |
### Agent controls
| Capability | What it enables |
| --------------------- | ---------------------- |
| `o11y_read_control` | View agent controls. |
| `o11y_create_control` | Create agent controls. |
| `o11y_update_control` | Update agent controls. |
| `o11y_delete_control` | Delete agent controls. |
### Custom dashboards
| Capability | What it enables |
| ------------------------------ | ------------------------- |
| `o11y_read_custom_dashboard` | View custom dashboards. |
| `o11y_create_custom_dashboard` | Create custom dashboards. |
| `o11y_update_custom_dashboard` | Update custom dashboards. |
| `o11y_delete_custom_dashboard` | Delete custom dashboards. |
### Provider-management API integrations
| Capability | What it enables |
| ------------------------------------------------- | --------------------------------------------------------- |
| `o11y_create_provider_management_api_integration` | Add provider analytics connections for Tokenomics. |
| `o11y_read_provider_management_api_integration` | View provider analytics connections used by Tokenomics. |
| `o11y_update_provider_management_api_integration` | Update provider analytics connections used by Tokenomics. |
| `o11y_delete_provider_management_api_integration` | Remove provider analytics connections used by Tokenomics. |
### Organization settings
| Capability | What it enables |
| ------------------------------------------- | --------------------------------------------- |
| `o11y_read_cost_settings_organization` | View organization cost settings. |
| `o11y_read_ai_usage_organization` | View AI usage for the organization. |
| `o11y_delete_log_data_organization` | Delete organization Agent Stream data. |
| `o11y_read_settings_organization` | View organization settings. |
| `o11y_update_settings_organization` | Update organization settings. |
| `o11y_read_ai_usage_aggregate_organization` | View aggregate AI usage for the organization. |
| `o11y_read_unredacted_data_organization` | View unredacted traces and annotation data. |
### Users
| Capability | What it enables |
| -------------------- | ----------------------------------- |
| `o11y_read_user_all` | View all users in the organization. |
## Related resources