# Permission combinations by job

Combined content and Management API permissions for common Hygraph jobs, such as opening Content, publishing, or using Schema.

Use this page when a job needs **more than one permission**. For detailed information about what each permission does on its own, see [Content permissions](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions) and [Management API permissions](https://hygraph.com/docs/getting-started/access-and-permissions/management-api-permissions). For information on how to create a role and toggle permissions in Studio, see [Roles](https://hygraph.com/docs/getting-started/access-and-permissions/user-roles-and-permissions).

## Permission layers

Most of the scenarios below combine the following layers:

| Layer | What it controls | Scope |
|-------|------------------|--------|
| **Management API permissions** | What the role can **see** in Studio (tabs, buttons, settings screens). Some also authorize Management API calls. | Global |
| **Content permissions** | What the role can **do** to entries (read, create, update, delete, publish, unpublish, read versions). | Per environment |

A role can have content **Read** and still see an empty **Content** tab. This isn't always intuitive because the two permissions that unlock sidebar visibility live under Management API permissions.

**Add entry**, **Save**, **Publish**, and **Delete** each require a separate [Studio content actions](https://hygraph.com/docs/getting-started/access-and-permissions/management-api-permissions#studio-content-actions) permission on top of everything above. A button can render and still fail the moment someone clicks it, the same way a form can look submittable and reject on submit.

**Note:**

**Read existing environments** is required to open the project. Do not disable it.

## Content

The first row below covers opening **Content** in the sidebar. Every other row assumes that access already exists.

| Job | Management API permissions | Content permissions |
|-----|----------------------------|---------------------|
| See **Content** | `Read public view groups` and `Read public content views` | **Read** on **DRAFT** for each model that should appear |
| Create an entry | `Create new entries` | `Read`, `Create`, and `Read versions`. Also `Read` on `DRAFT` and the default locale. |
| Edit a draft | `Update existing non published entries` | `Read`, `Update`, and `Read versions` |
| Edit a published entry | `Update published entries` | `Read`, `Update`, and `Read versions` |
| Publish | `Publish non-published entries` and `Update published entries` | `Read` and `Publish` (Draft plus the target stage). Add `Read versions` if publishing from the entry form. |
| Unpublish | `Update published entries` | `Read` on all stages and `Unpublish`. Add `Read versions` if unpublishing from the entry form. |
| Delete | `Delete existing entries` | `Read` on all stages, `Delete`, and `Unpublish` on every stage except Draft. Add `Read versions` if deleting from the entry form. |
| **Update view** | `Update public content views` and `Update system content views` | Not applicable. Views aren't scoped by content permissions. |

## Assets

The first row below covers opening **Assets** in the sidebar. The second row assumes that access already exists.

| Job | Management API permissions | Content permissions |
|-----|----------------------------|---------------------|
| See **Assets** | `Read public view groups` and `Read public content views` | `Read` on the **Asset** model |
| Upload or create assets | `Create new entries` | `Read` and `Create` on the **Asset** model. Also `Read` on `DRAFT` and the default locale. Add `Read versions` if creating from the asset editor. |

## Schema

| Job | Minimum Management API permissions |
|-----|-----------------------------------|
| Open Schema | `Can see schema view`, plus at least one of `Read existing models`, `Read existing components`, `Read existing enumerations`, or `Read remote sources`. Taxonomy read permissions do not count. |
| Browse models | `Can see schema view` and `Read existing models` |
| Add a model | `Can see schema view`, `Read existing models`, and `Create new models` |
| Edit model settings | `Can see schema view`, `Read existing models`, and `Update existing models` |
| Edit model fields | Everything in `Edit model settings`, plus `Update existing fields`. Add `Create new fields` or `Delete existing fields` to add or remove fields. |
| Open taxonomies | Everything in `Open Schema`, plus `Read taxonomy`. Add `Read taxonomy node` to open taxonomy nodes. |
| Create a taxonomy | Everything in `Open taxonomies`, plus `Create taxonomy` and `Create taxonomy node`. |

## Apps

| Job | Minimum Management API permissions |
|-----|-----------------------------------|
| See **Apps** | `Can see apps section` |
| Install an app | `Can see apps section` and `Can add app installations` |
| Edit an app installation | `Can see apps section` and `Can update app installations` |
| Uninstall an app | `Can see apps section` and `Can delete app installations` |

## Project settings

| Job | Minimum Management API permissions |
|-----|-----------------------------------|
| Open environments | `Read existing environments` and `Can see environment selector` |
| Clone an environment | `Read existing environments`, `Can see environment selector`, and `Create new environment` |
| Open Content API settings | `Can see project settings` and `Read existing models` |
| Manage Members | `Can see Team Member Settings`, plus `Invite a user into an existing project`, `Assign a role to a user`, or `Remove a user from an existing project` as needed |
| Manage Roles | `Can see Role & Permissions Settings`, plus `Create new roles`, `Update existing roles`, or `Delete an existing role` as needed |
| Add, edit, or delete content permissions | `Can read content permissions`, plus `Can create content permissions`, `Can update content permissions`, or `Can delete content permissions` as needed |
| Duplicate a custom role | `Create new roles` and an available custom role seat |
| Manage Permanent Auth Tokens | `Can read existing permanent auth tokens`, plus create, update, or delete as needed |
| Use API Playground with content | `Can use the playground`, plus the content `Read` the query needs |
| Restore a backup | `Read existing environment backups and their details` and `Restore an existing environment backup to a standard environment` |

## AI

| Job | Minimum Management API permissions |
|-----|-----------------------------------|
| Edit guidelines | `Read AI guidelines` and `Update AI guidelines` |
| Create an agent | `Read agent config` and `Create an agent` |
| Edit or enable an agent | **Read agent config** and **Update an agent config** |
| Delete an agent | `Remove a user from an existing project`. `Delete an agent config` and `Remove an agent` have no effect today. |
| Manually run an agent from the content editor or table | `Trigger an agent run`, plus Content access |

## API access without Studio

Studio UI flags do not apply to tokens. Configure [content permissions on the PAT](https://hygraph.com/docs/getting-started/access-and-permissions/api-access#configure-content-permissions) or for [unauthenticated requests to the Content API](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions#set-up-unauthenticated-access-to-the-content-api).

| Job | Minimum |
|-----|---------|
| Create or update content with a PAT | Matching content permissions: `Create` / `Update` (and `Read`). Do not rely on `Create new entries` or other UI-only Management API flags. |
| Modify schema with a PAT | Management API action permissions such as `Read existing models` and `Create new models`.  |

## Content reviewer

Start from a new custom role. The following are read-only permissions in Studio.

**Management API**

- `Read public view groups`
- `Read public content views`

**Content** (per environment)

- Model: All, or the models they should see
- `Read`: all locales, `DRAFT` (and `PUBLISHED` if they should compare stages)
- **Read versions**

## Content editor

Everything in **Content reviewer**, plus the permissions below. These permissions allow create and update in Studio, but do not include publish.

**Management API**

- `Create new entries`
- `Update existing non published entries`
- `Update published entries` if they save entries that are already published

**Content**

- `Create`
- `Update`
- Default locale included

## Content publisher

Everything in **Content editor**, plus the permissions below. These permissions allow publish and unpublish in Studio.

**Management API**

- `Publish non-published entries`
- `Update published entries` (also required to unpublish in Studio)

**Content**

- `Publish` (from Draft to the target stage)
- `Unpublish` if they should take content off a stage

## Schema developer

Start from a new custom role. The permissions below are for Schema only; they do not open Content.

**Management API**

- `Can see schema view`
- `Read existing models`, `Read existing components`, `Read existing fields`, `Read existing enumerations`, `Read remote sources`, `Read taxonomy`, and `Read taxonomy node`
- `Create new models`, `Create new components`, `Create new fields`, `Create new enumerations`, `Create remote sources`, `Create taxonomy`, and `Create taxonomy node`
- Add update and delete permissions only for the schema elements they should change
- `Can use the playground` if they should test queries in Studio

Do not enable `Read public view groups` or `Read public content views` unless they also need Content.

## Project settings admin

Start from a new custom role. The permissions below are for Project Settings only; they do not open Content or Schema. Add the screens they should manage, for example:

- `Can see project settings`
- `Read existing webhooks` (and create, update, or delete as needed)
- `Can see Team Member Settings` and `Invite a user into an existing project`
- `Can see Role & Permissions Settings` and `Update existing roles`
- `Can read existing permanent auth tokens`

## What's next

- [Roles](https://hygraph.com/docs/getting-started/access-and-permissions/user-roles-and-permissions): Create custom roles and assign members.
- [Content permissions](https://hygraph.com/docs/getting-started/access-and-permissions/content-api-permissions): Actions, locales, stages, conditions, and how to scope a permission.
- [Management API permissions](https://hygraph.com/docs/getting-started/access-and-permissions/management-api-permissions): Full list of Management API permissions.
- [API access](https://hygraph.com/docs/getting-started/access-and-permissions/api-access): Configure content permissions on a Permanent Auth Token.
- [Set up unauthenticated access to the Content API](https://hygraph.com/docs/getting-started/access-and-permissions/api-access#unauthenticated-requests-content-api): Serve content without a token.