# Scopes

> Understand how scopes control access and actions in NOVA Cloud. NOVA evaluates access using scoped permissions which are mapped to API endpoints and enforced during request authorization.

As Admins and Operators mostly work through the user interface, the mapping between scopes and API endpoints is abstracted away.

However, for Developers it becomes relevant when:

- Working directly with the API
- Troubleshooting authorization issues

### Organization Scope (Global)

| Permission | Admin | Developer | Operator |
| - | - | - | - |
| Access all physical cells (`can_access_all_physical_cells`) | ✓ | – | – |
| Manage all physical cells (`can_manage_all_physical_cells`) | ✓ | – | – |
| Delete all physical cells (`can_delete_all_physical_cells`) | ✓ | – | – |
| Manage users (`can_manage_users`) | ✓ | – | – |
| View audit log (`can_view_audit_log`) | ✓ | – | – |
| Register physical cells (`can_register_physical_cells`) | ✓ | ✓ | – |
| Create virtual cells (`can_create_virtual_cells`) | ✓ | ✓ | – |
| Access all virtual cells (`can_access_all_virtual_cells`) | ✓ | ✓ | – |
| Manage all virtual cells (`can_manage_all_virtual_cells`) | ✓ | ✓ | – |
| Delete all virtual cells (`can_delete_all_virtual_cells`) | ✓ | ✓ | – |

### Instance Scope (Per Instance)

| Permission | Admin | Developer | Operator |
| - | - | - | - |
| Manage license (`can_manage_license`) | ✓ | – | – |
| Manage backups (`can_manage_backups`) | ✓ | ✓ | – |
| Manage cells (`can_manage_cells`) | ✓ | ✓ | – |
| Manage cloud connection (`can_manage_cloud_connection`) | ✓ | ✓ | – |
| Restore system (`can_restore_system`) | ✓ | ✓ | – |
| Update system (`can_update_system`) | ✓ | ✓ | – |
| Access license (`can_access_license`) | ✓ | ✓ | ✓ |
| Access system (`can_access_system`) | ✓ | ✓ | ✓ |
| Backup system (`can_backup_system`) | ✓ | ✓ | ✓ |

### Cell Scope (Per Cell)

| Permission | Admin | Developer | Operator |
| - | - | - | - |
| Manage members (`can_manage_members`) | ✓ | ✓ | – |
| Manage apps (`can_manage_apps`) | ✓ | ✓ | – |
| Manage cells (`can_manage_cells`) | ✓ | ✓ | – |
| Manage bus ios (`can_manage_bus_ios`) | ✓ | ✓ | – |
| Manage controllers (`can_manage_controllers`) | ✓ | ✓ | – |
| Manage programs (`can_manage_programs`) | ✓ | ✓ | – |
| Write collision world (`can_write_collision_world`) | ✓ | ✓ | – |
| View status (`can_view_status`) | ✓ | ✓ | ✓ |
| View members (`can_view_members`) | ✓ | ✓ | ✓ |
| Access apps (`can_access_apps`) | ✓ | ✓ | ✓ |
| Operate bus ios (`can_operate_bus_ios`) | ✓ | ✓ | ✓ |
| Access cells (`can_access_cells`) | ✓ | ✓ | ✓ |
| Read collision world (`can_read_collision_world`) | ✓ | ✓ | ✓ |
| Operate controllers (`can_operate_controllers`) | ✓ | ✓ | ✓ |
| Plan motion (`can_plan_motion`) | ✓ | ✓ | ✓ |
| Read objects (`can_read_objects`) | ✓ | ✓ | ✓ |
| Write objects (`can_write_objects`) | ✓ | ✓ | ✓ |
| Read datasets (`can_read_datasets`) | ✓ | ✓ | ✓ |
| Write datasets (`can_write_datasets`) | ✓ | ✓ | ✓ |
| Operate programs (`can_operate_programs`) | ✓ | ✓ | ✓ |
| Operate virtual controllers (`can_operate_virtual_controllers`) | ✓ | ✓ | ✓ |
| Access system (`can_access_system`) | ✓ | ✓ | ✓ |

### What this means

- User interfaces are designed around tasks.
- Roles reflect responsibilities in an automation workflows.
- If an action, e.g., a button, a menu item, or a feature, is visible but fails:
  - Verify the user’s role
  - For cell related actions, verify cell membership