Canonical list of every permission flag in NetLock RMM, grouped by feature area, with a note on what each flag gates.

Permission reference

This appendix is the canonical catalogue of every permission flag NetLock RMM exposes to role configuration. Use it as a lookup when the User Settings matrix is too dense to navigate, when you are auditing an existing user's rights, or when you are designing a new role and need to see everything the product can gate.

For how to create a user and assign these flags, see Chapter 14 — Users & Roles.

X.2.1 The access model in one page

NetLock RMM has a flat, per-user permission model. Three things are worth internalising before you start assigning flags.

No role templates. The Role column on the Users list is a free-text label — cosmetic metadata that appears in the list and in audit entries but grants no permissions by itself. Two users with the same Role label can hold completely different flag sets. There is no Administrator template that implies a permission set. Set flags one user at a time, or duplicate an existing user's flags by hand.
Permissions are boolean flags. Each flag is either granted or not granted. Access control is exercised through the matrix on User Settings, where section-level switches enable a block and child checkboxes gate finer-grained actions within the block. Turning a parent switch off disables every child regardless of the child's stored value.
Tenant scoping is layered on top. Independent of flags, every user record holds a list of tenants they may act on. A user with every flag enabled but only tenant Acme selected sees and acts on devices, tickets, and events scoped to Acme alone. Global pages (Settings, Events, Audit, Users, Reports library) are not tenant-scoped; feature pages that operate on devices are.

Four specific facts shape how the flags below behave:

tickets_view_all_departments is a scope flag, not a feature flag. Users without it still see the Tickets page, create tickets, reply, and close tickets — but only on the department(s) they are assigned to. The flag widens their view across every department; it does not gate the ticket surface itself.
settings_system_mysql_console is a sub-permission. The System settings group is unlocked by settings_system_enabled, but the MySQL console that lives inside it takes a separate, narrower flag. Keep it off unless the user truly needs raw query access.
ai_enabled is the global AI master. It gates whether any AI affordance in the product activates for the user. The individual surfaces (Script Analysis, Remote Shell AI, Event Analysis, Sensor & Job Creation, Event Log Analysis) are not per-user flags — they are deployment-wide toggles under Settings → AI / LLM. See A.11.
reports_godmode is not a user permission. Raw-SQL access in the Report Builder is a deployment-wide setting, managed under Settings → Reports. The same applies to God Mode for Dashboards and Custom Fields, each of which is configured on its own settings page and applies to every eligible user on the deployment. See A.12.

The remaining sections enumerate every flag.

X.2.2 Dashboard

Flag	Gates
`dashboard_enabled`	Access to the `Dashboard` page and the Panel Builder.

See Chapter 2 — Dashboard.

X.2.3 Devices

Flag	Gates
`devices_authorized_enabled`	The main `Devices` list and device detail view.
`devices_general`	The `General` tab on the device detail.
`devices_software`	The `Software` tab on the device detail.
`devices_task_manager`	The `Task Manager` tab.
`devices_antivirus`	The `Antivirus` tab (Windows Defender).
`devices_events`	The `Events` tab on the device detail.
`devices_updates`	The `Updates` tab on the device detail.
`devices_remote_shell`	The Remote Shell action.
`devices_remote_file_browser`	The File Browser action.
`devices_remote_control`	Remote Control — H.264 over Relay, JPEG over SignalR fallback.
`devices_remote_eventlog_viewer`	The Remote Event Log viewer (Windows only).
`devices_remote_registry_editor`	The Registry Editor (Windows only).
`devices_snmp_tools`	The SNMP Tools dialog.
`devices_shutdown`	The Shutdown command.
`devices_reboot`	The Reboot command.
`devices_wake_on_lan`	Wake on LAN.
`devices_force_sync`	The Force Sync action.
`devices_deauthorize`	The Deauthorize action — removes the device and returns its Agent to the Unauthorized queue.
`devices_move`	Move a device between tenants, locations, or groups.
`devices_unauthorized_enabled`	The `Unauthorized Devices` list at `/unauthorized_devices`.
`devices_unauthorized_authorize`	The action that authorises a pending device.
`devices_world_map_enabled`	The `Device World Map`.

See Chapter 3 — Devices.

X.2.4 Tenants, Locations & Groups

Flag	Gates
`tenants_enabled`	The `Tenants` list.
`tenants_add`	Create a tenant.
`tenants_manage`	Open tenant detail.
`tenants_edit`	Save tenant edits.
`tenants_delete`	Delete a tenant.
`tenants_locations_add`	Create a location.
`tenants_locations_manage`	Open location detail.
`tenants_locations_edit`	Save location edits.
`tenants_locations_delete`	Delete a location.
`tenants_groups_add`	Create a group.
`tenants_groups_edit`	Edit a group.
`tenants_groups_delete`	Delete a group.

See Chapter 4 — Tenants, Locations & Groups.

X.2.5 Automations

Flag	Gates
`automation_enabled`	The `Automations` page.
`automation_add`	Create an automation.
`automation_edit`	Edit an automation.
`automation_delete`	Delete an automation.

See Chapter 5 — Automations.

X.2.6 Policies

Flag	Gates
`policies_enabled`	The `Policies` list.
`policies_add`	Create a policy.
`policies_manage`	Open `Policy Settings` for editing.
`policies_edit`	Save changes in `Policy Settings`.
`policies_delete`	Delete a policy.

See Chapter 6 — Policies.

X.2.7 Patch Management

Flag	Gates
`patch_management_enabled`	The `Patch Management` page — all four tabs (`Update Approval`, `Vulnerabilities`, `Update History`, `Settings`).

The page enables or disables as a whole; there is no per-tab flag. See Chapter 7 — Patch Management.

X.2.8 Collections

Master switch

Flag	Gates
`collections_enabled`	The top-level `Collections` navigation group. Every sub-feature below requires this flag and its own flag.

Antivirus Controlled Folder Access

The UI for this feature is excluded from the current release. The flags still exist in the model and will apply if the UI ships in a future release.

Flag	Gates
`collections_antivirus_controlled_folder_access_enabled`	Access to the ACFA rulesets page.
`collections_antivirus_controlled_folder_access_add`	Create an ACFA ruleset.
`collections_antivirus_controlled_folder_access_manage`	Open an ACFA ruleset for viewing.
`collections_antivirus_controlled_folder_access_edit`	Save edits to an ACFA ruleset.
`collections_antivirus_controlled_folder_access_delete`	Delete an ACFA ruleset.
`collections_antivirus_controlled_folder_access_processes_add`	Add a process to an ACFA ruleset.
`collections_antivirus_controlled_folder_access_processes_edit`	Edit a process in an ACFA ruleset.
`collections_antivirus_controlled_folder_access_processes_delete`	Remove a process from an ACFA ruleset.

Application Control

Flag	Gates
`collections_application_control_enabled`	The rulesets page at `/application_control_manage_rulesets`.
`collections_application_control_add`	Create a ruleset.
`collections_application_control_manage`	Open a ruleset for viewing.
`collections_application_control_edit`	Save edits to a ruleset.
`collections_application_control_delete`	Delete a ruleset.
`collections_application_control_rules_add`	Add a rule to a ruleset.
`collections_application_control_rules_edit`	Edit an existing rule.
`collections_application_control_rules_delete`	Delete a rule.

See Chapter 8.6.

Device Control

Flag	Gates
`collections_device_control_enabled`	The whitelist and blocked-devices pages under `/device-control`.
`collections_device_control_manage`	View the whitelist and the blocked-devices tab.
`collections_device_control_delete`	Delete a whitelist entry.

There is no _add flag — the only creation path is the approval flow on Blocked Devices, which is gated by the _manage flag plus the ability to act on the specific scope. See Chapter 8.7.

Sensors

Flag	Gates
`collections_sensors_enabled`	The `Sensors` page.
`collections_sensors_add`	Create a sensor.
`collections_sensors_edit`	Edit a sensor.
`collections_sensors_delete`	Delete a sensor.

See Chapter 8.3.

Scripts

Flag	Gates
`collections_scripts_enabled`	The `Scripts` page.
`collections_scripts_add`	Create a script.
`collections_scripts_edit`	Edit a script.
`collections_scripts_delete`	Delete a script.

See Chapter 8.1.

Jobs

Flag	Gates
`collections_jobs_enabled`	The `Jobs` page.
`collections_jobs_add`	Create a job.
`collections_jobs_edit`	Edit a job.
`collections_jobs_delete`	Delete a job.

See Chapter 8.2.

Custom Fields

Flag	Gates
`collections_custom_fields_enabled`	The `Custom Fields` page.
`collections_custom_fields_add`	Create a custom field definition.
`collections_custom_fields_edit`	Edit a definition.
`collections_custom_fields_delete`	Delete a definition.

See Chapter 8.4.

App Hub

Flag	Gates
`collections_app_hub_enabled`	The `App Hub` page.
`collections_app_hub_add`	Add a manual app entry.
`collections_app_hub_manage`	Edit, delete, or refresh catalogues.
`collections_app_hub_browse_winget`	Browse the Winget catalogue.
`collections_app_hub_browse_flathub`	Browse the Flathub catalogue.
`collections_app_hub_browse_chocolatey`	Browse the Chocolatey catalogue.

See Chapter 8.5.

Software Deployment

Flag	Gates
`collections_software_deployment_enabled`	The `Manage Deployments` page.
`collections_software_deployment_view`	Open a deployment detail view.
`collections_software_deployment_add`	Create a deployment.
`collections_software_deployment_manage`	Cancel, retry, rename, clone, or delete a deployment.

See Chapter 8.8.

X.2.9 File Server

Flag	Gates
`file_server_enabled`	The `File Server` page.
`file_server_add`	Upload a file or create a folder.
`file_server_edit`	Edit file metadata.
`file_server_delete`	Delete a file or a directory.
`file_server_netlock`	Access to the internal `/netlock` folder. Keep off for everyone except deployment operators.

See Chapter 9.1.

X.2.10 Relay Server

Flag	Gates
`relay_server_enabled`	The `Relay Server` page.
`relay_server_manage`	The `Manage API Keys` action.
`relay_server_add`	Create a relay session.
`relay_server_edit`	Enable or disable a persistent session.
`relay_server_delete`	Close or delete a session.

See Chapter 9.2.

X.2.11 Website Uptime Monitoring

Flag	Gates
`website_uptime_monitoring_enabled`	Access to the page.

The page has one access flag; add, edit, and delete affordances on the page are controlled by the single _enabled flag. See Chapter 9.3.

X.2.12 Port Scanner

Flag	Gates
`port_scanner_enabled`	Access to the page and every action on it.

See Chapter 9.4.

X.2.13 Events & Audit

Flag	Gates
`events_enabled`	The `Events` page.
`audit_enabled`	The `Audit` page.

The two are deliberately independent. Most operators need events_enabled; audit_enabled is usually reserved for security and compliance roles. See Chapter 12 — Events & Audit.

X.2.14 Users

Flag	Gates
`users_enabled`	The `Users` list.
`users_add`	The `Add User` dialog.
`users_manage`	Open `User Settings` for a user.
`users_edit`	Save changes in `User Settings`, including the permission matrix.
`users_delete`	Delete a user.

A user who holds users_edit can edit every other user's permission flags, including their own. Treat this flag the way you would treat a root bit on Unix. See Chapter 14 — Users & Roles.

X.2.15 Reports

Flag	Gates
`reports_enabled`	The `Reports` page.
`reports_create`	Create a report template.
`reports_edit`	Edit a template.
`reports_delete`	Delete a template.
`reports_generate`	Run a one-off report generation.
`reports_schedules`	Create or manage recurring report schedules.
`reports_brand_templates`	Manage brand templates on the `Brands` tab.

reports_godmode is not listed here — it is a deployment-wide toggle under Settings → Reports, not a user permission. See Chapter 11 — Reports and A.12.

X.2.16 Tickets

Flag	Gates
`tickets_enabled`	The Tickets module — the list, the detail view, Time Tracking.
`tickets_create`	Create a ticket from the UI.
`tickets_edit`	Edit ticket metadata in the `Details` tab.
`tickets_delete`	Delete a ticket (hard delete — no recycle bin).
`tickets_assign`	Change the assignee on a ticket.
`tickets_manage_departments`	Manage departments.
`tickets_manage_templates`	Manage response templates.
`tickets_manage_labels_types`	Manage labels and issue types.
`tickets_manage_customers`	Manage customer and contact records.
`tickets_manage_sla`	Manage SLAs.
`tickets_view_time_tracking`	The `Time Tracking` view.
`tickets_manage_webhooks`	Manage per-department ticket webhooks.
`tickets_view_statistics`	The `Statistics` view.
`tickets_view_all_departments`	Scope flag. Widens the operator's view to every department. Without it, the operator sees only tickets on the department(s) they are assigned to.

See Chapter 10 — Tickets.

X.2.17 Settings

Every flag below gates a specific Settings sub-page. The top-level Settings nav group requires settings_enabled; each sub-page requires its own flag in addition.

Access to the Settings group

Flag	Gates
`settings_enabled`	The `Settings` navigation entry.

Overview & Licensing (self-hosted-only pages)

Flag	Gates
`settings_overview_enabled`	The `Overview` page.
`settings_licensing_enabled`	The `Licensing` page.

See A.1.

System & Maintenance

Flag	Gates
`settings_system_enabled`	The `System` settings sub-page.
`settings_system_mysql_console`	The MySQL console embedded in System settings. Narrower than `settings_system_enabled` — grant only to operators who truly need raw query access.
`settings_maintenance_enabled`	The `Maintenance` page.
`settings_maintenance_manage`	Create or edit maintenance tasks.
`settings_protocols_enabled`	The `Logging` page. The flag name is `protocols` for historical reasons; the Console labels the page `Logging`. See A.9.

Updates & Database

Flag	Gates
`settings_updates_enabled`	The `Updates` page.
`settings_database_enabled`	The `Database` management page.

See A.2 and A.3.

Security & Integration

Flag	Gates
`settings_remote_screen_enabled`	The `Remote Screen` defaults page.
`settings_ip_whitelist_enabled`	The `IP Whitelist` page.
`settings_sso_enabled`	The `SSO` configuration page.

See A.4 and A.7.

Customisation

Flag	Gates
`settings_whitelabeling_enabled`	The `Whitelabeling` page.
`settings_globalization_enabled`	The `Globalization` page.
`settings_custom_fields_enabled`	The `Custom Fields` settings page (allowed tables and God Mode for Custom Fields).

See A.5, A.6, and A.12.

Dashboards & Reports defaults

Flag	Gates
`settings_dashboards_enabled`	The `Dashboards` settings page (allowed tables and God Mode for Dashboards).
`settings_reports_enabled`	The `Reports` settings page (allowed tables and God Mode for Reports).

See A.12.

AI / LLM

Flag	Gates
`settings_ai_llm_enabled`	The `AI / LLM` configuration page.

See A.11.

X.2.18 Notifications

The Notifications page has one master flag and five per-channel flag groups. Every channel follows the same pattern, with Email adding one extra flag for SMTP.

Master

Flag	Gates
`settings_notifications_enabled`	Access to the `Notifications` page.

Per-channel pattern

For each channel <channel> in mail, microsoft_teams, telegram, ntfysh, webhook:

Flag	Gates
`settings_notifications_<channel>_enabled`	The channel's tab on the Notifications page.
`settings_notifications_<channel>_add`	Create a recipient on this channel.
`settings_notifications_<channel>_test`	Send a test to a recipient on this channel.
`settings_notifications_<channel>_edit`	Edit a recipient on this channel.
`settings_notifications_<channel>_delete`	Delete a recipient on this channel.

Email extras

Flag	Gates
`settings_notifications_mail_smtp`	The deployment-wide SMTP configuration dialog. Separate from `mail_edit` — a user can manage recipients without being granted the ability to change the global SMTP server.

See A.8.

X.2.19 AI

Flag	Gates
`ai_enabled`	The global AI master. When off, every AI surface in the product is hidden for this user regardless of deployment settings.
`ai_chat_page_enabled`	The `AI Chat` page at `/ai-chat`.

The individual in-line AI surfaces (script analysis button, event-analysis button, sensor and job assistants, remote-shell AI, event-log AI) are enabled at the deployment level under Settings → AI / LLM — not per user. See Chapter 13 and A.11.

X.2.20 Designing a role

Because there are no templates, the pattern most deployments settle on is a handful of composed presets. As a practical starting point:

Read-only observer — dashboard_enabled, devices_authorized_enabled, devices_general, events_enabled, reports_enabled, reports_generate.
Level-1 technician — observer plus devices_remote_shell, devices_remote_file_browser, devices_remote_control, devices_reboot, devices_force_sync, collections_enabled, collections_scripts_enabled, tickets_enabled, tickets_create, tickets_edit.
Level-2 engineer — L1 plus the policies_* flags, automation_*, most of the collections_*_add / _edit flags, patch_management_enabled, and audit_enabled for incident review.
Deployment operator — L2 plus settings_*_enabled for the settings sub-pages they own, users_enabled / _add / _manage / _edit if they onboard staff, and deliberately not settings_system_mysql_console or users_delete unless strictly required.

Treat these as a sketch, not a policy. The shipped product has no saved role templates, so every deployment ends up writing its own catalogue.

Permission reference

On this page