port-permissions

Port permissions

Port's RBAC shows up in two independent places that reuse the same roles/users/teams shape: context lake entities (a blueprint's read, register, update, unregister) and pages/dashboards (read, update). This skill covers both, plus the roles and ownership model that backs them.

Permissions on a workflow's own SELF_SERVE_TRIGGER node are a separate, simpler mechanism owned by the port-workflows skill, see its permissions reference instead of this one.

Prerequisites

• Go over the port-getting-started skill first if this is your first time working with Port.
• The blueprint or page whose permissions you're changing already exists.
• If Port's MCP server is connected, use list_blueprints to read current blueprint definitions before editing, and simulate_blueprint_permissions to test a context lake permission change before applying it. There is no MCP tool that writes permissions directly, every step below applies changes through the raw API, UI, or Terraform. Search search_port_knowledge_sources for anything this skill doesn't cover.

How to configure it

1. Know the two building blocks every permission type reuses: Port's three roles (Admin, blueprint Moderator, Member) and the $team ownership meta-property that backs every ownedByTeam flag. See references/roles-and-ownership.md.
2. Set context lake (blueprint/entity) permissions: who can read, register, update, or unregister entities of a blueprint, down to a single property or relation, a dynamic read policy, and the built-in permission simulator. See references/context-lake-permissions.md.
3. Set page and dashboard permissions: who can view or edit a catalog or dashboard page. See references/page-permissions.md.
4. Setting permissions on a workflow trigger instead? That's a different, simpler shape scoped to one SELF_SERVE_TRIGGER node, not this skill, use the port-workflows skill's permissions reference.