From 158064a60e08fd6795a4ac82fd32d04493d9e0b6 Mon Sep 17 00:00:00 2001 From: Alexa Date: Fri, 23 Oct 2026 08:10:26 -0500 Subject: [PATCH 1/2] update core and custom roles tables for coverage gaps --- .../roles-and-permissions/core-roles.md | 42 ++++++++++++++++++- .../custom-roles/permissions-reference.md | 2 +- 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/content/manuals/security/roles-and-permissions/core-roles.md b/content/manuals/security/roles-and-permissions/core-roles.md index bc613fccbb4f..754fc29ac307 100644 --- a/content/manuals/security/roles-and-permissions/core-roles.md +++ b/content/manuals/security/roles-and-permissions/core-roles.md @@ -6,7 +6,9 @@ description: >- keywords: >- Docker roles, core roles, Member role, Editor role, Owner role, organization permissions, company owner, Docker Hub, Docker Scout, Docker Build Cloud, - OIDC, teams, access control, Docker Business, custom roles + OIDC, teams, access control, Docker Business, custom roles, organization + access tokens, licenses, AI Governance, Docker Hardened Images, + Docker Offload, Cloud Sandboxes weight: 10 aliases: - /enterprise/security/roles-and-permissions/core-roles/ @@ -50,6 +52,7 @@ These permissions apply organization-wide. | Explore images and extensions | ✅ | ✅ | ✅ | | Star, favorite, vote, and comment on content | ✅ | ✅ | ✅ | | Pull images | ✅ | ✅ | ✅ | +| Push images | ❌ | ✅ | ✅ | | Create and publish an extension | ✅ | ✅ | ✅ | | Become a Verified, Official, or Open Source publisher | ❌ | ❌ | ✅ | | Edit and delete publisher repository logos | ❌ | ✅ | ✅ | @@ -87,18 +90,23 @@ Use team permissions for that. | Invite members | ❌ | ❌ | ✅ | | Manage members | ❌ | ❌ | ✅ | | Manage member roles and permissions | ❌ | ❌ | ✅ | +| Manage custom roles | ❌ | ❌ | ✅ | +| Manage organization access tokens | ❌ | ❌ | ✅ | | View member activity | ❌ | ❌ | ✅ | | Export and reporting | ❌ | ❌ | ✅ | | Image Access Management | ❌ | ❌ | ✅ | | Registry Access Management | ❌ | ❌ | ✅ | | Namespace access control | ❌ | ❌ | ✅ | | Set up Single Sign-On (SSO) and SCIM | ❌ | ❌ | ✅ \* | +| Manage verified domains and domain audit settings | ❌ | ❌ | ✅ | | Require Docker Desktop sign-in | ❌ | ❌ | ✅ \* | +| Manage Desktop settings policies | ❌ | ❌ | ✅ | | Manage billing information (for example, billing address) | ❌ | ❌ | ✅ | | Manage payment methods (for example, credit card or invoice) | ❌ | ❌ | ✅ | | View billing history | ❌ | ❌ | ✅ | | Manage subscriptions | ❌ | ❌ | ✅ | | Manage seats | ❌ | ❌ | ✅ | +| Assign and revoke licenses and manage auto-assign rules | ❌ | ❌ | ✅ | | Upgrade and downgrade plans | ❌ | ❌ | ✅ | > [!TIP] @@ -129,6 +137,38 @@ _\* If not part of a company_ | Buy minutes | ❌ | ❌ | ✅ | | Manage subscription | ❌ | ❌ | ✅ | +### AI Governance + +| Permission | Member | Editor | Owner | +| :--------------------- | :----- | :----- | :---- | +| View policies | ✅ | ✅ | ✅ | +| Manage policies | ❌ | ❌ | ✅ | +| View audit logs | ❌ | ❌ | ✅ | +| Manage audit settings | ❌ | ❌ | ✅ | + +### Docker Hardened Images + +Members can create, update, and delete customizations unless the organization +has denied customizations for all members. + +| Permission | Member | Editor | Owner | +| :-------------------------- | :----- | :----- | :---- | +| View mirrors | ✅ | ✅ | ✅ | +| Create and delete mirrors | ❌ | ✅ | ✅ | +| Manage customizations | ✅ | ✅ | ✅ | + +### Docker Offload + +| Permission | Member | Editor | Owner | +| :----------------------------------------- | :----- | :----- | :---- | +| View account status, leases, and zones | ✅ | ✅ | ✅ | + +### Cloud Sandboxes + +| Permission | Member | Editor | Owner | +| :-------------------------- | :----- | :----- | :---- | +| Create and use sandboxes | ❌ | ❌ | ✅ | + ## Next steps - [Custom roles](/manuals/security/roles-and-permissions/custom-roles/_index.md): diff --git a/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md index d0cafa418164..3397033b69ac 100644 --- a/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -33,7 +33,7 @@ or edit a custom role](manage.md). | Member management | Manage organization members, invites, and roles | | View custom roles | View existing custom roles and their permissions | | Manage custom roles | Full access to custom role management and assignment | -| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | +| Manage organization access tokens | Create, update, and delete organization access tokens | | View activity logs | Access organization audit logs and activity history | | View usage reports | Download organization usage reports (pulls, storage) | | View domains | View domains and domain audit settings | From b304d670ca9791a0b4ab383c2c7cea3d4ddd3cc7 Mon Sep 17 00:00:00 2001 From: Alexa Date: Fri, 23 Oct 2026 10:22:04 -0500 Subject: [PATCH 2/2] Narrow PR to Manage licenses row in Organization management. Revert the broader core-roles and permissions-reference coverage edits so this change only documents Owner-only Manage licenses. Co-authored-by: Cursor --- .../roles-and-permissions/core-roles.md | 43 +------------------ .../custom-roles/permissions-reference.md | 2 +- 2 files changed, 3 insertions(+), 42 deletions(-) diff --git a/content/manuals/security/roles-and-permissions/core-roles.md b/content/manuals/security/roles-and-permissions/core-roles.md index 754fc29ac307..88cdc65f9098 100644 --- a/content/manuals/security/roles-and-permissions/core-roles.md +++ b/content/manuals/security/roles-and-permissions/core-roles.md @@ -6,9 +6,7 @@ description: >- keywords: >- Docker roles, core roles, Member role, Editor role, Owner role, organization permissions, company owner, Docker Hub, Docker Scout, Docker Build Cloud, - OIDC, teams, access control, Docker Business, custom roles, organization - access tokens, licenses, AI Governance, Docker Hardened Images, - Docker Offload, Cloud Sandboxes + OIDC, teams, access control, Docker Business, custom roles weight: 10 aliases: - /enterprise/security/roles-and-permissions/core-roles/ @@ -52,7 +50,6 @@ These permissions apply organization-wide. | Explore images and extensions | ✅ | ✅ | ✅ | | Star, favorite, vote, and comment on content | ✅ | ✅ | ✅ | | Pull images | ✅ | ✅ | ✅ | -| Push images | ❌ | ✅ | ✅ | | Create and publish an extension | ✅ | ✅ | ✅ | | Become a Verified, Official, or Open Source publisher | ❌ | ❌ | ✅ | | Edit and delete publisher repository logos | ❌ | ✅ | ✅ | @@ -90,23 +87,19 @@ Use team permissions for that. | Invite members | ❌ | ❌ | ✅ | | Manage members | ❌ | ❌ | ✅ | | Manage member roles and permissions | ❌ | ❌ | ✅ | -| Manage custom roles | ❌ | ❌ | ✅ | -| Manage organization access tokens | ❌ | ❌ | ✅ | | View member activity | ❌ | ❌ | ✅ | | Export and reporting | ❌ | ❌ | ✅ | | Image Access Management | ❌ | ❌ | ✅ | | Registry Access Management | ❌ | ❌ | ✅ | | Namespace access control | ❌ | ❌ | ✅ | | Set up Single Sign-On (SSO) and SCIM | ❌ | ❌ | ✅ \* | -| Manage verified domains and domain audit settings | ❌ | ❌ | ✅ | | Require Docker Desktop sign-in | ❌ | ❌ | ✅ \* | -| Manage Desktop settings policies | ❌ | ❌ | ✅ | | Manage billing information (for example, billing address) | ❌ | ❌ | ✅ | | Manage payment methods (for example, credit card or invoice) | ❌ | ❌ | ✅ | | View billing history | ❌ | ❌ | ✅ | | Manage subscriptions | ❌ | ❌ | ✅ | | Manage seats | ❌ | ❌ | ✅ | -| Assign and revoke licenses and manage auto-assign rules | ❌ | ❌ | ✅ | +| Manage licenses | ❌ | ❌ | ✅ | | Upgrade and downgrade plans | ❌ | ❌ | ✅ | > [!TIP] @@ -137,38 +130,6 @@ _\* If not part of a company_ | Buy minutes | ❌ | ❌ | ✅ | | Manage subscription | ❌ | ❌ | ✅ | -### AI Governance - -| Permission | Member | Editor | Owner | -| :--------------------- | :----- | :----- | :---- | -| View policies | ✅ | ✅ | ✅ | -| Manage policies | ❌ | ❌ | ✅ | -| View audit logs | ❌ | ❌ | ✅ | -| Manage audit settings | ❌ | ❌ | ✅ | - -### Docker Hardened Images - -Members can create, update, and delete customizations unless the organization -has denied customizations for all members. - -| Permission | Member | Editor | Owner | -| :-------------------------- | :----- | :----- | :---- | -| View mirrors | ✅ | ✅ | ✅ | -| Create and delete mirrors | ❌ | ✅ | ✅ | -| Manage customizations | ✅ | ✅ | ✅ | - -### Docker Offload - -| Permission | Member | Editor | Owner | -| :----------------------------------------- | :----- | :----- | :---- | -| View account status, leases, and zones | ✅ | ✅ | ✅ | - -### Cloud Sandboxes - -| Permission | Member | Editor | Owner | -| :-------------------------- | :----- | :----- | :---- | -| Create and use sandboxes | ❌ | ❌ | ✅ | - ## Next steps - [Custom roles](/manuals/security/roles-and-permissions/custom-roles/_index.md): diff --git a/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md b/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md index 3397033b69ac..d0cafa418164 100644 --- a/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md +++ b/content/manuals/security/roles-and-permissions/custom-roles/permissions-reference.md @@ -33,7 +33,7 @@ or edit a custom role](manage.md). | Member management | Manage organization members, invites, and roles | | View custom roles | View existing custom roles and their permissions | | Manage custom roles | Full access to custom role management and assignment | -| Manage organization access tokens | Create, update, and delete organization access tokens | +| Manage organization access tokens | Create, update, and delete repositories in this org. Push/pull or registry actions not included | | View activity logs | Access organization audit logs and activity history | | View usage reports | Download organization usage reports (pulls, storage) | | View domains | View domains and domain audit settings |