Roles and permissions

SQIP combines a tenant role with optional permissions. Your effective access is limited to the tenants you belong to.

Standard roles

Role	Intended user	Typical access
`tenant-admin`	Owner of a tenant	Full tenant control, including users, access grants, and connector installation
`cluster-admin`	Streaming platform operator	Clusters, namespaces, topics, schemas, API keys, connector operations, and logs
`usage-admin`	Operations or reporting user	Usage Metering and Monitoring
`user`	Application team member	Basic membership; access is added permission by permission

Platform administrators operate across all tenants and also manage tenant administrator accounts. This is separate from ordinary tenant membership.

Additional permissions

A tenant administrator can grant specific capabilities beyond a user's role. For example, a user may be allowed to read topics and monitoring without being able to create or delete resources.

Permissions are tenant-scoped. Access to one tenant does not grant access to another.

Why menus can differ

The left navigation displays only areas you can use. Inside each area, create, update, export, operate, and delete controls are shown only when you have the matching permission.

If a guide references a control you cannot see:

Confirm that you selected or belong to the correct tenant.
Open Access and RBAC → Access guide if available.
Ask the tenant administrator for the narrowest permission needed for your task.

User credentials and API keys

Your SQIP sign-in account is for the web console. Applications use Pulsar API keys instead.

Credential	Used by	Scope
SQIP user account	People using the web console	Assigned tenant roles and permissions
Pulsar API key	Applications producing or consuming messages	One tenant, cluster, and namespace
Connector credential	A managed connector accessing an external system	One connector installation

One-time secrets

API keys and connector credentials are intentionally handled as one-time values:

A new API key is displayed only once.
Connector credentials are entered during installation and are not shown again.
Notification destinations and SSO client secrets are saved without being redisplayed.

Warning

Store secrets in your organization's approved secret manager. Never paste them into topic names, URLs, headers, descriptions, support tickets, or audit searches.

Least-privilege guidance

Give producers only produce when they do not need to read.
Give consumers only consume when they do not need to publish.
Use usage-admin for read-only operational visibility.
Reserve tenant-admin for people who manage access and sensitive connector changes.
Revoke API keys and remove tenant memberships when access is no longer needed.