---
title: "Permissions"
description: "What a permission is and how it maps to a resource and an action."
canonical: "https://docs.cm.com/governance/guides/core-concepts/permissions"
---

# Permissions

> What a permission is and how it maps to a resource and an action.

Source: https://docs.cm.com/governance/guides/core-concepts/permissions

A **permission** is one specific action someone is allowed to do, such as reading data, changing a configuration or managing users.

## Who defines them

Permissions are owned by the application teams. The application defines its own permissions. Governance only stores them and checks them. You cannot change what an application's permissions mean.

## How they are named

A permission name has two parts, joined by a dot: the application's **namespace** and the permission name.

```text
Namespace.Name
```

For example, `Governance.Editor`. Each application owns its own namespace, so two applications can use the same permission name without clashing.

## Permissions and roles

A permission can't be assigned directly to a user. It can only be given through a [role](https://docs.cm.com/governance/guides/core-concepts/roles): permissions are grouped into roles, and you assign the role.

| Concept | Answers |
| - | - |
| **Permission** | What can be done? |
| **Role** | How are permissions grouped? |
| **Resource** | On what? |

## Related

- [Roles](https://docs.cm.com/governance/guides/core-concepts/roles)
- [Resources](https://docs.cm.com/governance/guides/core-concepts/resources)
- [Custom roles](https://docs.cm.com/governance/guides/core-concepts/custom-roles)