Managing access to feature flags, target groups, and custom properties is essential for safely releasing features and maintaining control over application behavior. This page explains how to use CloudBees platform’s role-based access control (RBAC) system to configure custom roles specifically for feature management. Use this content to create custom roles that define precise permissions for individuals or teams responsible for creating, managing, or deploying feature flags.
By assigning roles with appropriate permission categories, privilege levels, and resource scopes, you can ensure that users have the right level of access, helping to reduce misconfigurations, support safe experimentation, and enforce governance policies.
| For a general overview of how role-based access control (RBAC) works across the platform, including concepts such as predefined roles, permission categories, and privilege levels, refer to the Role-based access control documentation. |
Custom role creation
Within feature management, you can assign custom roles that define what users or teams are allowed to do. These roles may apply at either the organization level or application level, depending on how access should be scoped.
This section provides example configurations for custom roles within feature management. While the examples may not match the exact scenario you’re setting up, they provide a foundation you can build on to create your own specific custom role. Each example outlines the minimum permissions required for common use cases or access levels.
Feature management admin role
As an org admin, you may need to assign full permissions for feature flags, target groups, and properties to trusted users. This custom role grants full control across all feature management categories.
-
Navigate to .
-
Select Create role.
-
Name the role (for example,
FM Admin).-
Select
next to Custom role, and then enter a name for the role. -
Select
next to Description to enter a description, such as a summary of permissions granted.
-
-
Select the category: Feature management.
-
Assign the following permissions:
-
For the Flag permission, select all checkboxes: Read, Create, Update, Delete, and Execute.
-
For the Target group permission, select all checkboxes: Read, Create, Update, Delete, and Execute.
-
For the Custom property, select all checkboxes: Read, Create, Update, Delete, and Execute.
Figure 1. Custom role: Feature management administrator
-
-
Select Save.
-
To Grant the role select .
Feature management target group admin role
You may want to assign this role to a team responsible for managing audience targeting and rollout strategies.
-
Follow the same process as provided above, except for the permissions.
-
Assign the following permissions:
-
For the Custom property, select Read.
-
For the Flag permission, select Read.
-
For the Target group permission, select all checkboxes: Read, Create, Update, Delete, and Execute.
Figure 2. Custom role: Feature management target group admin
-
-
Select Save.
-
Assign the role using .
Feature management flag owner role
You may want to assign a flag owner role to users who are responsible for creating, managing, and deploying feature flags, but who don’t need full access to target groups or custom properties.
-
Follow the same process as provided above, except for the permissions.
-
Assign the following permissions:
-
For the Custom property, select Read.
-
For the Flag permission, select all checkboxes: Read, Create, Update, Delete, and Execute.
-
For the Target group permission, select: Read.
Figure 3. Custom role: Feature management flag owner
-
-
Select Save.
-
Assign the role using .
Feature management read-only role
You may want to allow users to review flag configuration or rollout status without making updates. This role is useful for product managers, analysts, or audit/compliance teams.
-
Follow the same process as provided above, except for the permissions.
-
Assign the following permissions:
-
For the Flag permission, select Read.
-
For the Target group permission, select Read.
-
For the Custom property, select Read.
Figure 4. Custom role: Feature management read-only
-
-
Select Save.
-
Assign the role using .
The feature management read-only role must include Read privileges for flags, target groups, and custom properties. Without complete read access across these categories, the user may experience limited access to flag configurations, evaluation behavior, and visibility in the UI.