---
source_url: https://www.pubnub.com/docs/security/access-control/permission-model
title: Access Manager permission model
updated_at: 2026-10-13T08:57:28.000Z
---

# Access Manager permission model

> For AI agents: documentation index at https://www.pubnub.com/llms-full.txt

[Access Manager](https://www.pubnub.com/docs/security/access-control/overview.md) permissions set what your app's clients can do on channels, channel groups, and user metadata. Your server grants them in a token. For what members of your organization can do in the Admin Portal, see [Admin Portal roles](https://www.pubnub.com/docs/security/admin-portal-roles.md).

Access Manager grants permissions per resource. Each token lists the resources the bearer can access and the flags that apply to each one.

## Resource types and permission flags

| Resource | Permission flags |
| --- | --- |
| Channel | `read`, `write`, `delete`, `get`, `update`, `manage`, `join` |
| Channel group | `read`, `manage` |
| UUID metadata | `get`, `update`, `delete` |

## What each flag permits

| Flag | Operations |
| --- | --- |
| `read` | Subscribe to a channel or channel group. Fetch messages. List and download files. Manage push notification registrations. |
| `write` | Publish and signal on a channel. Send a file to a channel. Add a message action. |
| `delete` | Delete messages from history. Delete a file. Delete metadata. Remove a message action. |
| `get` | Read channel or UUID metadata. List channel members or memberships. |
| `update` | Write channel or UUID metadata. |
| `manage` | Add or remove channels in a channel group. Delete a channel group. Set or remove channel members. |
| `join` | Set or remove channel memberships (UUID resource side). |

Permissions do not cascade. A `read` grant on a channel group does not grant `read` on the individual channels in that group.

## Authorized UUID

| Field | Description |
| --- | --- |
| `authorized_uuid` | Optional. Binds the token to one User ID. SDKs name this parameter `authorizedUserId` or `authorizedUuid`. PubNub rejects requests using the token from any other User ID. Must match an existing User ID set during SDK initialization. |

## Scope

| Scope type | Description |
| --- | --- |
| Exact name | Grants permission for one named resource. |
| RE2 pattern | Grants permission for all resources whose names match the pattern. Evaluated server-side. Backreferences and lookaround assertions are not supported. |

## Related pages

* [Access Manager](https://www.pubnub.com/docs/security/access-control/overview.md). How the authorization flow works.
* [Grant, change, and revoke permissions](https://www.pubnub.com/docs/security/access-control/manage-permissions.md). Issue and manage tokens from your server.
* [Operations to permissions mapping](https://www.pubnub.com/docs/security/access-control/operations-permissions-mapping.md). Which permission each PubNub API operation requires.
* [Admin Portal roles](https://www.pubnub.com/docs/security/admin-portal-roles.md). What organization members can do in the Admin Portal.

Last updated at: 2026-10-13T08:57:28.000Z