VCF Automation RBAC Architecture Overview

VCF Automation uses a multi-tenant, hierarchical RBAC model driven by granular rights across three scopes: Provider, Organization and Project.

Official documentation: Managing Predefined User Roles in VCF Automation

Hierarchy levels

• Provider scope (system level). Governs the underlying platform infrastructure, regions, supervisor clusters, and tenant organization creation.
• Organization scope (tenant level). Governs tenant-wide settings, identity providers, security policies, integrations, and project definitions.
• Project scope (boundary level). Governs resource boundaries, entitlement, catalog consumption, template design, and vSphere namespace self-service.

Built-in roles and capabilities

1. Project-level roles (project scope)

Project Administrator

Project admin and author

• Full management: manage project members and role assignments.
• Design and authoring: create, edit, clone, export, and delete blueprints and templates.
• Content and governance: manage property groups, custom resources, and resource actions.
• Infrastructure and CCI: manage namespace self-service settings, shared VPC and subnet access, and project content libraries.
• Deployments: full control over all deployed catalog instances in the project.

Project Advanced User

Power user or developer

• Resource usage: request items from the service catalog.
• Content management: manage project content libraries.
• Deployment control: manage deployed instances, including power operations, snapshots and scale.
• Infrastructure access: view and use vSphere namespaces and shared VPCs.
• Restrictions: cannot create or edit blueprints, manage project members, or alter project settings.

Project User

Catalog consumer

• Catalog request: browse published catalog items and submit deployment requests.
• Day-2 operations: perform basic lifecycle actions, such as start, stop, reboot and console access, on their own deployed instances.
• Restrictions: cannot create templates or blueprints, manage project settings, or modify project membership.

Project Auditor

Project inspector

• Read-only: view project details, published blueprints, catalog items, deployed inventory, subnets, and approval statuses.
• Restrictions: cannot submit requests or modify any project assets.

2. Organization-level roles (tenant scope)

Organization Administrator

Tenant owner

• Global tenant control: full administrative control across the entire tenant organization.
• Identity and access: manage users, groups, service accounts, identity providers (OIDC, LDAP, SAML), and custom roles.
• Project administration: create, edit, and delete projects across the organization.
• Security and networking: configure distributed firewalls, VPCs, transit gateways, IP blocks, certificates, and secrets.
• Platform settings: configure global policies (approval, lease, Day-N), integrations (vRO, AD, Git), and billing and cost settings.

Organization Auditor

Compliance and audit

• Org-wide read-only: view all organization settings, audit logs, billing reports, projects, security rules, network topologies, and catalog items.
• Restrictions: cannot create, edit, or request any items.

Organization User

Base entry role

• Portal access: provides basic UI portal access and API token generation. Relies on project membership for actual resource consumption.

3. Provider-level roles (platform scope)

System Administrator

Platform operator

• Infrastructure control: manages the underlying vSphere host clusters, vCenter endpoints, NSX instances, Supervisor Cluster activations, and provider regions and zones.
• Tenant provisioning: onboards, configures, and manages tenant organizations.

Permission comparison matrix (project scope)

Function or capability	Project Administrator	Project Advanced User	Project User	Project Auditor
Browse catalog items	Yes	Yes	Yes	Yes
Request catalog deployments	Yes	Yes	Yes	No
Manage deployed instances	Yes (all)	Yes (project)	Yes (own)	No
Create and edit blueprints or templates	Yes	No	No	No
Manage property groups and custom resources	Yes	No	No	No
Manage project members and roles	Yes	No	No	No
Configure namespace self-service (CCI)	Yes	No	No	No
Manage project content libraries	Yes	Yes	No	No