For AI agents: a documentation index is available at the root level at /llms.txt and /llms-full.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
      • AstroFully-managed data operations, powered by Apache Airflow.
      • Astro Private CloudRun Airflow-as-a-service in your environment.
      • Professional ServicesExpert Airflow services for your enterprise's success.
    • Tools
      • Cosmos
      • Orbiter
      • CLI
      • AI SDK
      • Agents
      • Blueprint
      • UpdatesThe State of Airflow 2026See the insights from over 5,800 data practitioners in the full report. Download Now ➔
  • Customers
  • Docs
    • Insights
      • Blog
      • Webinars
      • Resource Library
      • Events
    • Education
      • Academy
      • What is Airflow?
  • Pricing
Get Started Free
    • Overview
      • Astro Support
      • Astro Office Hours
      • Global environment variables
      • Custom role permissions
      • Allowlist Astro domains
      • Feature previews
      • Deprecations
      • Airflow feature support
      • Azure Native ISV retirement
      • Security
      • Glossary
    • Book Office Hours

Product

  • Platform Overview
  • Astro
  • Astro Observe
  • Astro Private Cloud
  • Security & Trust
  • Pricing

Tools & Services

  • Cosmos
  • Docs
  • Professional Services
  • Product Updates

Use Cases

  • AI Ops
  • Data Observability
  • ETL/ELT
  • ML Ops
  • Operational Analytics
  • All Use Cases

Industries

  • Financial Services
  • Gaming
  • Retail
  • Manufacturing
  • Healthcare
  • All Industries

Resources

  • Academy
  • eBooks & Guides
  • Blog
  • Webinars
  • Events
  • The Data Flowcast Podcast
  • All Resources

Airflow

  • What is Airflow
  • Airflow on Astro
  • Airflow 3.0
  • Airflow Upgrades
  • Airflow Use Cases
  • Airflow 2.x End of Life

Company

  • Our Story
  • Customers
  • Newsroom
  • Careers
  • Contact

Support

  • Knowledge Base
  • Status
  • Contact Support
GitHubYouTubeLinkedInx
  • Legal
  • Privacy
  • Terms of Service
  • Consent Preferences

  • Do Not Sell or Share My Personal information
  • Limit the Use Of My Sensitive Personal Information

Apache Airflow®, Airflow, and the Airflow logo are trademarks of the Apache Software Foundation. Copyright © Astronomer 2026. All rights reserved.

LogoLogo
On this page
  • Deployment
  • Deployment Agents
  • Deployment Agents Tokens
  • Deployment Airflow AdminMenu
  • Deployment Airflow Astronomer
  • Deployment Airflow AuditLog
  • Deployment Airflow BrowseMenu
  • Deployment Airflow ClusterActivity
  • Deployment Airflow CustomMenu
  • Deployment Airflow Config
  • Deployment Airflow Connection
  • Deployment Airflow dag
  • Deployment Airflow DagCode
  • Deployment Airflow DagDependencies
  • Deployment Airflow DAGRun
  • Deployment Airflow Datasets
  • Deployment Airflow Docs
  • Deployment Airflow ImportError
  • Deployment Airflow Job
  • Deployment Airflow Plugin
  • Deployment Airflow Pool
  • Deployment Airflow Provider
  • Deployment Airflow SlaMiss
  • Deployment Airflow TaskInstance
  • Deployment Airflow TaskLog
  • Deployment Airflow TaskReschedule
  • Deployment Airflow Trigger
  • Deployment Airflow Variable
  • Deployment Airflow Website
  • Deployment Airflow XCom
  • Deployment Alerts
  • Deployment ApiTokens
  • Deployment Deploys
  • Deployment EnvObjects
  • Deployment Logs
  • Deployment Metrics
  • Deployment Observability
  • Deployment Teams
  • Deployment Users
  • Dag scope permissions
  • Dag Airflow AuditLog
  • Dag Airflow Dag
  • Dag Airflow DagCode
  • Dag Airflow DagDependencies
  • Dag Airflow DagRun
  • Dag Airflow HitlDetail
  • Dag Airflow Task
  • Dag Airflow TaskInstance
  • Dag Airflow TaskLog
  • Dag Airflow Version
  • Dag Airflow Warning
  • Dag Airflow Xcom
Reference

Custom role permissions reference

Edit this page
Built with
This is feature is only available if you are on the Enterprise tier or above. See Astro Plans and Pricing.
Preview
This feature is in Preview.

This document contains all available permissions that you can assign to a custom Deployment role or a custom Dag role. Permissions are organized by scope and object.

Deployment

  • deployment.get: Get information about the Deployment, including its details and resource configurations.
  • deployment.update: Update information about the Deployment, including its details and resource configurations.
  • deployment.delete: Delete the Deployment.

Deployment Agents

Airflow 3

This feature is only available for Airflow 3.x Deployments.

Remote Execution Agents are Airflow Workers, Triggerers, and Dag processors running in your remote environment with an Airflow 3 Deployment.

  • deployment.agents.get: Able to get the information about Remote Execution Agents running in Remote Deployments.
  • deployment.agents.update: Allow users with permissions to cordon and uncordon Remote Execution Agents in Remote Deployments.
  • deployment.agents.delete: Allow users with permissions to delete Remote Execution Agents in Remote Deployments.

Deployment Agents Tokens

Airflow 3

This feature is only available for Airflow 3.x Deployments.

Tokens used by external Airflow agents, including the Remote Execution Agent, to access Airflow APIs for remote task execution.

  • deployment.agentTokens.create: Create an access token to your Deployment for a Remote Execution Agent..
  • deployment.agentTokens.delete: Delete access tokens for Remote Agents.

Deployment Airflow AdminMenu

  • deployment.airflow.adminMenu.get: View the Admin menu in the Airflow UI.

Deployment Airflow Astronomer

  • deployment.airflow.astronomer.get: View the Astronomer menu in the Airflow UI.

Deployment Airflow AuditLog

  • deployment.airflow.auditLog.get: View the Audit Log menu in the Airflow UI.

Deployment Airflow BrowseMenu

  • deployment.airflow.browseMenu.get: View the Browse menu in the Airflow UI.

Deployment Airflow ClusterActivity

  • deployment.airflow.clusterActivity.get: View the Cluster Activity menu in the Airflow UI.

Deployment Airflow CustomMenu

  • deployment.airflow.customMenu.get: Create and use custom plugins for the Aiflow UI menu.

Deployment Airflow Config

  • deployment.airflow.config.get: View the Config menu in the Airflow UI.

Deployment Airflow Connection

  • deployment.airflow.connection.get: View connections in the Airflow UI.
  • deployment.airflow.connection.create: Create connections in the Airflow UI.
  • deployment.airflow.connection.update: Update connections in the Airflow UI.
  • deployment.airflow.connection.delete: Delete connections in the Airflow UI.

Deployment Airflow dag

  • deployment.airflow.dag.get: View dags in the Airflow UI.
  • deployment.airflow.dag.update: Update dags in the Airflow UI.
  • deployment.airflow.dag.delete: Delete dags in the Airflow UI.

Deployment Airflow DagCode

  • deployment.airflow.dagCode.get: View the source code for dags in the Airflow UI.

Deployment Airflow DagDependencies

  • deployment.airflow.dagDependencies.get: View the task dependencies for dags in the Airflow UI.

Deployment Airflow DAGRun

  • deployment.airflow.dagRun.get: View dag runs in the Airflow UI.
  • deployment.airflow.dagRun.create: Create dag runs in the Airflow UI.
  • deployment.airflow.dagRun.update: Update dag runs in the Airflow UI.
  • deployment.airflow.dagRun.delete: Delete dag runs in the Airflow UI.

Deployment Airflow Datasets

  • deployment.airflow.datasets.get: View the datasets for dags in the Airflow UI.

Deployment Airflow Docs

  • deployment.airflow.docs.get: View the documentation for dags in the Airflow UI.

Deployment Airflow ImportError

  • deployment.airflow.importError.get: View any import errors for dags in the Airflow UI.

Deployment Airflow Job

  • deployment.airflow.job.get: View scheduler jobs in the Airflow UI.

Deployment Airflow Plugin

  • deployment.airflow.plugin.get: View plugins in the Airflow UI.

Deployment Airflow Pool

  • deployment.airflow.pool.get: View pools in the Airflow UI.
  • deployment.airflow.pool.create: Create pools in the Airflow UI.
  • deployment.airflow.pool.update: Update pools in the Airflow UI.
  • deployment.airflow.pool.delete: Delete pools in the Airflow UI.

Deployment Airflow Provider

  • deployment.airflow.provider.get: View installed provider packages in the Airflow UI.

Deployment Airflow SlaMiss

  • deployment.airflow.slaMiss.get: View details about SLA misses in the Airflow UI.

Deployment Airflow TaskInstance

  • deployment.airflow.taskInstance.get: View task instances in the Airflow UI.
  • deployment.airflow.taskInstance.create: Create task instances in the Airflow UI.
  • deployment.airflow.taskInstance.update: Update task instances in the Airflow UI.
  • deployment.airflow.taskInstance.delete: Delete task instances in the Airflow UI.

Deployment Airflow TaskLog

  • deployment.airflow.taskLog.get: View task logs in the Airflow UI.

Deployment Airflow TaskReschedule

  • deployment.airflow.taskReschedule.get: View task reschedules in the Airflow UI.

Deployment Airflow Trigger

  • deployment.airflow.trigger.get: View information about triggers in the Airflow UI.

Deployment Airflow Variable

  • deployment.airflow.variable.get: View variables in the Airflow UI.
  • deployment.airflow.variable.create: Create variables in the Airflow UI.
  • deployment.airflow.variable.update: Update variables in the Airflow UI.
  • deployment.airflow.variable.delete: Delete variables in the Airflow UI.

Deployment Airflow Website

  • deployment.airflow.website.get: Access the Airflow UI homepage.

Deployment Airflow XCom

  • deployment.airflow.xcom.get: View XComs data in the Airflow UI.
  • deployment.airflow.xcom.delete: View XComs data in the Airflow UI.

Deployment Alerts

  • deployment.alerts.get: View configured Deployment alerts.
  • deployment.alerts.create: Create Deployment-level Astro alerts in the Astro UI or through the Astro API.
  • deployment.alerts.update: Update Deployment-level Astro alerts in the Astro UI or through the Astro API.
  • deployment.alerts.delete: Delete Deployment-level Astro alerts in the Astro UI or through the Astro API.

Deployment ApiTokens

  • deployment.apiTokens.get: View Deployment API tokens in the Astro UI or through the Astro API.
  • deployment.apiTokens.create: Create Deployment API tokens in the Astro UI or through the Astro API.
  • deployment.apiTokens.update: Update Deployment API tokens in the Astro UI or through the Astro API.
  • deployment.apiTokens.delete: Delete Deployment API tokens in the Astro UI or through the Astro API.
  • deployment.apiTokens.rotate: Rotate Deployment API tokens in the Astro UI or through the Astro API.

Deployment Deploys

  • deployment.deploys.get: View deploy history for the Deployment in the Astro UI or through the Astro API.
  • deployment.deploys.create: Make Deploys to the Deployment.
  • deployment.deploys.update: Roll back deploys to the Deployment.

Deployment EnvObjects

  • deployment.envObjects.get: View Airflow objects created in the Astro Environments page.
  • deployment.envObjects.create: Create Airflow objects in the Astro Environments page.
  • deployment.envObjects.update: Update Airflow objects in the Astro Environments page.
  • deployment.envObjects.delete: Delete Airflow objects in the Astro Environments page.

Deployment Logs

  • deployment.logs.get: View Deployment logs in the Astro UI.

Deployment Metrics

  • deployment.metrics.get: View Deployment Analytics in the Astro UI.

Deployment Observability

  • deployment.observability.event.create: Upload OpenLineage events.
  • deployment.observability.metrics.create: Upload OpenLineage metrics.

Deployment Teams

  • deployment.teams.get: View Teams belonging to a Deployment.
  • deployment.teams.update: Update Team membership to a Deployment.

Deployment Users

  • deployment.users.get: View users belonging to a Deployment.
  • deployment.users.update: Update user membership to a Deployment.

Dag scope permissions

Labs
Dag scope permissions are part of Dag-level access control, which is in Labs and requires Astro Runtime 3.1-12 or later. Reach out to your account team to enable this feature.

The following permissions are available when creating a custom role with the Scope set to Dag. Unlike Deployment-scope permissions that apply to all Dags in a Deployment, Dag-scope permissions apply only to the Dags that the role is bound to by Dag tag or Dag ID. See Dag-level access control for more information about creating and assigning custom Dag roles.

Dag Airflow AuditLog

  • dag.airflow.auditLog.get: View the audit log for the assigned Dags.

Dag Airflow Dag

  • dag.airflow.dag.get: View the assigned Dags in the Airflow UI.
  • dag.airflow.dag.update: Update the assigned Dags in the Airflow UI.
  • dag.airflow.dag.delete: Delete the assigned Dags in the Airflow UI.

Dag Airflow DagCode

  • dag.airflow.dagCode.get: View the source code for the assigned Dags in the Airflow UI.

Dag Airflow DagDependencies

  • dag.airflow.dagDependencies.get: View the task dependencies for the assigned Dags in the Airflow UI.

Dag Airflow DagRun

  • dag.airflow.dagRun.get: View Dag runs for the assigned Dags in the Airflow UI.
  • dag.airflow.dagRun.create: Create Dag runs for the assigned Dags in the Airflow UI.
  • dag.airflow.dagRun.update: Update Dag runs for the assigned Dags in the Airflow UI.
  • dag.airflow.dagRun.delete: Delete Dag runs for the assigned Dags in the Airflow UI.

Dag Airflow HitlDetail

  • dag.airflow.hitlDetail.get: View human-in-the-loop task details for the assigned Dags.
  • dag.airflow.hitlDetail.update: Update human-in-the-loop task details for the assigned Dags.

Dag Airflow Task

  • dag.airflow.task.get: View tasks for the assigned Dags in the Airflow UI.

Dag Airflow TaskInstance

  • dag.airflow.taskInstance.get: View task instances for the assigned Dags in the Airflow UI.
  • dag.airflow.taskInstance.update: Update task instances for the assigned Dags in the Airflow UI.
  • dag.airflow.taskInstance.delete: Delete task instances for the assigned Dags in the Airflow UI.

Dag Airflow TaskLog

  • dag.airflow.taskLog.get: View task logs for the assigned Dags in the Airflow UI.

Dag Airflow Version

  • dag.airflow.version.get: View version details for the assigned Dags.
  • dag.airflow.version.update: Update version details for the assigned Dags.
  • dag.airflow.version.delete: Delete version details for the assigned Dags.

Dag Airflow Warning

  • dag.airflow.warning.get: View warnings for the assigned Dags.
  • dag.airflow.warning.delete: Delete warnings for the assigned Dags.

Dag Airflow Xcom

  • dag.airflow.xcom.get: View XCom data for the assigned Dags in the Airflow UI.