Permissions

• Viewers can see task/runbook information, but can't request or execute tasks/runbooks.
• Requesters have all the permission of viewers, and can also request tasks/runbooks.
• Executers have all the permissions of requesters, and can also execute tasks/runbooks and others' requests.
• Admins have full access to the task/runbook, and can change configurations and permissions.

• Viewers can access the view, but cannot change view permissions.
• Admins can access the view and update permissions.

javascript
Copied
1
// list_orders.airplane.ts
2
export default airplane.task(
3
  {
4
    slug: "list_orders",
5
    permissions: {
6
      viewers: { groups: ["support"] },
7
      executers: { users: ["jordan@airplane.dev"] },
8
    },
9
  },
10
  async () => {...}
11
);

python
Copied
1
# list_orders.py
2
@airplane.task(
3
    permissions=airplane.ExplicitPermissions(
4
        viewers=airplane.PermissionAssignees(groups=["support"]),
5
        executers=airplane.PermissionAssignees(users=["jordan@airplane.dev"]),
6
    )
7
)
8
def list_orders():
9
    pass

yaml
Copied
1
# list_orders.task.yaml
2
permissions:
3
  viewers:
4
    groups:
5
      - support
6
  executers:
7
    users:
8
      - jordan@airplane.dev

javascript
Copied
1
// orders_dashboard.airplane.tsx
2
export default airplane.view(
3
  {
4
    slug: "orders_dashboard",
5
    name: "Orders Dashboard",
6
    permissions: {
7
      viewers: { groups: ["support"] },
8
    },
9
  },
10
  OrdersDashboard,
11
);

javascript
Copied
1
// orders.airplane.ts
2
const PERMISSIONS = {
3
  viewers: { groups: ["support"] },
4
  executers: { users: ["jordan@airplane.dev"] },
5
};
6

7
export const listOrder = airplane.task(
8
  { slug: "list_orders", permissions: PERMISSIONS },
9
  async () => {...}
10
);
11

12
export const updateOrder = airplane.task(
13
  { slug: "update_order", permissions: PERMISSIONS },
14
  async () => {...}
15
);

python
Copied
1
# orders_airplane.py
2
PERMISSIONS = airplane.ExplicitPermissions(
3
  viewers=airplane.PermissionAssignees(groups=["support"]),
4
  executers=airplane.PermissionAssignees(users=["jordan@airplane.dev"]),
5
)
6

7
@airplane.task(permissions=PERMISSIONS)
8
def list_orders():
9
    pass
10

11
@airplane.task(permissions=PERMISSIONS)
12
def update_order():
13
    pass

javascript
Copied
1
// list_orders.airplane.ts
2
export default airplane.task(
3
  {
4
    slug: "list_orders",
5
    permissions:
6
      process.env.AIRPLANE_ENV_SLUG === "prod"
7
        ? {
8
            viewers: {
9
              groups: ["support"],
10
            },
11
          }
12
        : "team_access",
13
  },
14
  async () => {...}
15
);

python
Copied
1
# list_orders_airplane.py
2
@airplane.task(
3
    permissions="team_access"
4
    if os.environ.get("AIRPLANE_ENV_SLUG") == "prod"
5
    else airplane.ExplicitPermissions(
6
        viewers=airplane.PermissionAssignees(groups=["support"]),
7
    ),
8
)
9
def list_orders():
10
    pass

yaml
Copied
1
# list_orders.task.yaml
2
permissions: team_access
3

4
environments:
5
  prod:
6
    permissions:
7
      viewers:
8
        groups:
9
          - support

• Task viewers (default) Anyone who can view the task can also view the run. This means that if the task is team-accessible, the run can be viewed by anyone on the team. If the run has explicit permions enabled, all Viewers on the task can also view any run of the task.
• Task participants Can only be viewed by those who execute, request, or approve the run. This is useful for runs that contain sensitive information, such as credentials, that should only be viewed by those who are directly involved in the run, and not by anyone who can view the task.

TypeScriptPythonYAMLUI

typescript
Copied
1
// list_orders.airplane.ts
2
export default airplane.task(
3
  {
4
    slug: "list_orders",
5
    defaultRunPermissions: "task-participants",
6
  },
7
  async () => {...}
8
);

python
Copied
1
# list_orders_airplane.py
2
@airplane.task(
3
    default_run_permissions="task-participants",
4
)
5
def list_orders():
6
    pass

In your task definition file (the file with extension .task.yaml):

yaml
Copied
1
# list_orders.task.yaml
2
defaultRunPermissions: task-participants

In the Advanced section of the task editor: