Workflow Permissions
Access to the Workflows and Human Tasks views in the Integration Control Plane (ICP) is controlled by roles, so each person sees only the work that belongs to them. This page covers the permissions that open each view and the roles that carry them by default.
The Workflow-Management permissions
Workflow management adds four permissions in the Workflow-Management domain. Assign them through roles and groups, the same way as every other ICP permission. See Access control for the model.
| Permission | Allows |
|---|---|
workflow_mgt:view_workflows | View workflow executions and review activities. |
workflow_mgt:manage_workflows | Start, suspend, resume, cancel, and terminate workflow executions, and decide review activities. |
workflow_mgt:view_human_tasks | View human tasks and review activities. |
workflow_mgt:manage_human_tasks | Complete, fail, and cancel human tasks, reassign them and change their deadlines, and decide review activities. |
Default role grants
| Role | Human tasks | Workflow executions |
|---|---|---|
| Super Admin, Admin, Project Admin | View and manage | View and manage |
| Developer | View and manage | View only |
| Viewer | View only | No access |
The project-level Workflows and Human Tasks pages check permissions granted at project level or above. A user whose workflow permissions were granted only on individual integrations does not pass that check and must use the integration-level page instead.
How roles decide who sees a task
Permissions decide who can open the workflow views. Roles decide which tasks and reviews appear inside them.
When you open a task list, ICP sends your username and your ICP role names to the runtime. The runtime returns only the tasks that list one of your roles as an eligible role, or that name you as a user or an administrator.
Role names must match exactly, including uppercase and lowercase letters. For example, a task declared for manager in the workflow code is visible only to users holding an ICP role named exactly manager.
RequestDecision request = check ctx->awaitHumanTask("checkExpenseRequest",
{"claimId": claim.claimId, "amount": claim.amount}, userRoles = "manager");
Create the ICP roles that are required to complete the human task (manager, finance, support-lead, and so on), grant them the workflow permissions above, and map them to the groups whose members should decide those tasks.
Super admins are also given a synthetic admin role when calls reach the runtime. That role matches only tasks and reviews that explicitly declare admin, so it is not a way to see everything.
What's next
- Workflow executions — browse executions, read the timeline, and control a running instance
- Access control — roles, groups, and mappings in ICP
- Complete human tasks — decide the tasks and reviews these permissions gate