Access Control

Velerion uses role-based access control scoped to a workspace, with optional per-environment restriction. A member’s effective permission is the intersection of their role and the environments that role is granted on.

Built-in roles

Role	Read	Deploy	Manage secrets	Manage members
viewer	✓
developer	✓	dev, staging
release-manager	✓	all
admin	✓	all	✓	✓

Custom roles are available on enterprise plans. They are defined as an allow-list of permission strings, for example agents:deploy, connections:write, traces:read.

Service accounts

CI should never authenticate as a person. Create a service account per pipeline and scope it to the narrowest environment set that works.

velerion service-account create ci-deploy \
  --role release-manager \
  --environments staging,prod \
  --expires 90d

The command prints a token exactly once. Store it in your CI secret manager immediately.

# In CI
export VELERION_TOKEN="$CI_VELERION_TOKEN"
velerion promote --agent support-triage --from staging --to prod --yes

Danger

Tokens are bearer credentials with no additional device binding. Rotate them on the 90-day default and revoke immediately if a pipeline log may have captured one.

Single sign-on

SAML 2.0 and OIDC are both supported. Once SSO is enforced, password login is disabled for every member of the workspace except break-glass admins, which are listed explicitly under Settings → Authentication.

Audit log

Every mutating action is recorded with actor, environment, target and request ID. The log is queryable for 400 days and exportable:

velerion audit export --since 2026-07-01 --format jsonl > audit-july.jsonl

Request IDs in the audit log match the x-velerion-request-id header returned by the API, which makes it straightforward to correlate a support ticket with the exact call that caused it.