SKAO Octopus Role Assignments

This page documents the full set of Entra app roles used across SKAO Octopus deployments and the current role assignments by person.

Note: Email addresses are managed in Microsoft Entra and are not stored here. This file records display names and role levels only.

---

Full role list

SKA-Low (ROLE_PREFIX=low)

App role value	Octopus role	Level
octopus-low-viewer	Viewer	1
octopus-low-user	User	2
octopus-low-operator	Operator	3
octopus-low-engineer	Engineer	4
octopus-low-admin	Admin	5

SKA-Mid (ROLE_PREFIX=mid)

App role value	Octopus role	Level
octopus-mid-viewer	Viewer	1
octopus-mid-user	User	2
octopus-mid-operator	Operator	3
octopus-mid-engineer	Engineer	4
octopus-mid-admin	Admin	5

PSI (ROLE_PREFIX=psi)

App role value	Octopus role	Level
octopus-psi-viewer	Viewer	1
octopus-psi-user	User	2
octopus-psi-operator	Operator	3
octopus-psi-engineer	Engineer	4
octopus-psi-admin	Admin	5

STFC (ROLE_PREFIX=stfc)

App role value	Octopus role	Level
octopus-stfc-viewer	Viewer	1
octopus-stfc-user	User	2
octopus-stfc-operator	Operator	3
octopus-stfc-engineer	Engineer	4
octopus-stfc-admin	Admin	5

---

Current assignments

https://confluence.skatelescope.org/display/SWSI/Octopus+Overview#OctopusOverview-CurrentAAAroles

---

Notes

• A user only needs to be assigned their highest role per deployment — role levels are inclusive upward (an Operator can do everything a User and Viewer can).

• Users with roles from multiple deployments (e.g. both octopus-low-admin and octopus-mid-admin) are resolved independently per deployment: each Octopus instance only recognises roles matching its own ROLE_PREFIX.

• To add a new deployment, create the five octopus-<prefix>-* app roles in Entra and set ROLE_PREFIX=<prefix> in both the backend environment and the frontend config.js for that deployment.