# Permission Sets Suger uses Salesforce Permission Sets to strictly control user access. These permission sets determine which Suger Tabs are visible to a user and which Action Buttons (e.g., Create Private Offer) appear on their record pages. For configurations related to the external Suger Integration platform (such as API credentials or mapping rules), please refer to [the Suger Integration Setup Guide](/integrations/salesforce). :::note **Admin Privileges:** Suger Permission Sets **do not restrict** users with System Administrator privileges. Admins inherently possess full Read/Write access to all Suger features and Cloud Partners, regardless of the specific permission set assigned to them. ::: --- ## How to Access Permission Sets To view or assign these permissions in your Salesforce environment: 1. Click the **Gear Icon (⚙️)** in the top-right corner of the screen and select Setup. 1. In the **Quick Find** box on the left sidebar, type `Permission Sets`. 1. Select **Permission Sets** from the results to view the list of available Suger permissions. 1. All Suger-related permission sets begin with the prefix `Suger`. Assign the appropriate set based on the user's role in your sales cycle. Suger provides granular Permission Sets to control access based on Role (Admin vs. User), Module (Marketplace vs. Co-sell), and Cloud Partner (AWS, Azure, GCP). Use the tables below to assign the correct permissions to your users. --- ## Core Roles & Admin Permissions These permission sets provide high-level access control. | Permission Set Name | Description & Capabilities | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Suger Approval Offer | Grants permission to **Approve** or **Reject** Marketplace **Offers** (via the `Approve_Offer` custom permission). The approval process can be enabled via Salesforce integration settings in the [Suger Console](https://console.suger.io). | | Suger Approval Cosell | Grants permission to **Approve** or **Reject** **Co-sell Referrals** (via the `Approve_Cosell` custom permission). Assign separately from Suger Approval Offer if a user should be able to approve referrals but not offers (or vice versa). | | Suger Integrator | **Integration User Only.** Grants full Read/Write access to all Suger objects, including the Settings page and configurations. Do not assign this to human users. | | Suger Integrator (Salesforce Integration License) | **API User Only.** Grants full system access specifically for users holding the Salesforce Integration License. Do not assign this to standard human users. | | Suger User | **Standard User.** Grants full Read/Write access to all Suger objects (Offers, Referrals, etc.) across all clouds. **Excludes** access to the Settings page. | | Suger User - Read Only | **Global View-Only.** Grants view-only access to all Suger data. Users cannot create or edit records. | | Suger User - Cosell | Grants Read/Write access specifically to **Co-sell Referrals** for _all_ cloud partners. | | Suger User - Marketplace | Grants Read/Write access to **Offers, Entitlements, Products, Buyers, and Companies** for all cloud partners (Excludes access to Co-sell Referrals). | --- ## Co-Sell Cloud-Specific Permissions Use these permissions to restrict a user's **Referral** access to a specific Cloud Provider. These permissions also affect the user's visibility into CoSell Insights, such as Engagement Score, Possible Sales Reps, and related metrics. These permissions **do not** grant access to Offers, Entitlements, Products, or Companies(Buyers). | Permission Set Name | Description | | -------------------------------- | ----------------------------------------------------------------- | | Suger Cosell (Read Only) | View-only access to Co-sell Referrals for **all** cloud partners. | | Suger Cosell - AWS | Read/Write access to Co-sell Referrals for **AWS** only. | | Suger Cosell - AWS (Read Only) | View-only access to Co-sell Referrals for **AWS** only. | | Suger Cosell - Azure | Read/Write access to Co-sell Referrals for **Azure** only. | | Suger Cosell - Azure (Read Only) | View-only access to Co-sell Referrals for **Azure** only. | | Suger Cosell - GCP | Read/Write access to Co-sell Referrals for **GCP** only. | | Suger Cosell - GCP (Read Only) | View-only access to Co-sell Referrals for **GCP** only. | --- ## Marketplace Cloud-Specific Permissions Use these permissions to restrict a user's **Offer & Entitlement** access to a specific Cloud Provider. These permissions **exclude** access to Referrals. :::note Assigning any of the permission sets below automatically grants access to shared Marketplace objects, including **Buyers**, **Companies**, and **Products**. The "Cloud-Specific" restriction only applies to Offers and Entitlements. ::: | Permission Set Name | Description | | ------------------------------------- | ----------------------------------------------------------------------- | | Suger Marketplace (Read Only) | View-only access to Offers and Entitlements for **all** cloud partners. | | Suger Marketplace - AWS | Read/Write access to **AWS** Offers and Entitlements. | | Suger Marketplace - AWS (Read Only) | View-only access to **AWS** Offers and Entitlements. | | Suger Marketplace - Azure | Read/Write access to **Azure** Offers and Entitlements. | | Suger Marketplace - Azure (Read Only) | View-only access to **Azure** Offers and Entitlements. | | Suger Marketplace - GCP | Read/Write access to **GCP** Offers and Entitlements. | | Suger Marketplace - GCP (Read Only) | View-only access to **GCP** Offers and Entitlements. | | Suger Marketplace - SNOWFLAKE | Read/Write access to **Snowflake** Offers and Entitlements. | | Suger Marketplace - SNOWFLAKE (Read Only) | View-only access to **Snowflake** Offers and Entitlements. | --- ## Funding Permissions Use these permissions to grant access to **AWS Funding** features (e.g., Suger Funding Request objects, funding approval workflows). These are typically assigned in addition to a marketplace permission set when a user needs to manage funding alongside their normal Offer/Entitlement work. | Permission Set Name | Description | | -------------------------- | ------------------------------------------------------------------------------------------ | | Suger Funding | Read/Write access to AWS Funding operations. | | Suger Funding (Read Only) | View-only access to AWS Funding operations. | --- ## Add-on Permissions These permission sets do not grant a baseline level of access on their own — they layer specific feature capabilities on top of a primary permission set. | Permission Set Name | Description | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Suger User Finance Operation | Grants access to **Finance Operation** features (Cancel / Request Refund) on the Suger Entitlement record page via the `Finance_Operation` custom permission. Finance Operation access also requires AWS marketplace write access (the `Write_AWS_Offer` custom permission), so this add-on **must be combined** with a base permission set that grants it — `Suger User`, `Suger User - Marketplace`, or `Suger User - Marketplace - AWS`. | --- ## Custom Permissions For detailed information about the custom permissions included in each permission set, see [Custom Permissions](/salesforce-app/salesforce-app-custom-permissions).