Create a self-service permission set

This guide covers creating a complete self-service permission set using dct-toolkit — creating users, access groups, roles, and tag-based scoping to enable controlled VDB operations for a team. Estimated time: 15 minutes.

Prerequisites

• dct-toolkit installed and configured with an admin-level API key

• At least one VDB available in your DCT environment

Scenario

We'll configure self-service access for a development team called Alpha Team with the following requirements:

• Ability to refresh and rollback their own VDBs

• Access only to VDBs tagged with Team=Alpha

• No ability to delete or provision new VDBs

Step 1: Create a user account

dct-toolkit create_account \
				email=alice.developer@company.com \
				username=alice.developer \
				password="SecurePassword123!" \
				tags='Team=Alpha' \
				--generate_api_key

				# Verify and record the account ID
			dct-toolkit search_accounts username=alice.developer

Tagging the account with Team=Alpha enables automatic access group assignment in a later step.

Step 2: Create an access group

dct-toolkit create_access_group \
				name="Alpha Team Access" \
				account_tags='Team=Alpha'

				# Verify and record the access group ID
				dct-toolkit search_access_groups name="Alpha Team Access"

				# Confirm Alice's account is included
			dct-toolkit get_access_group_by_id access_group_id="<ACCESS_GROUP_ID>" -js

Any account tagged Team=Alpha is automatically added to this group.

Step 3: Create a custom role

dct-toolkit create_role \
				name="VDB Self-Service User" \
				permissions='["VDB_REFRESH", "VDB_ROLLBACK", "VDB_START", "VDB_STOP", "VDB_ENABLE", "VDB_DISABLE", "BOOKMARK_READ", "SNAPSHOT_READ"]'

				# Verify and record the role ID
				dct-toolkit search_roles name="VDB Self-Service User"
			dct-toolkit get_role_by_id role_id="<ROLE_ID>" -js

Permissions explicitly excluded: VDB_PROVISION, VDB_DELETE, BOOKMARK_WRITE.

Step 4: Create and configure an access group scope

# Add a scope linking the role to the access group
				dct-toolkit add_access_group_scopes \
				access_group_id="<ACCESS_GROUP_ID>" \
				role_id="<ROLE_ID>" \
				object_type="VDB" \
				scope_type="TAG_MAPPING"

				# Get the scope ID from the access group details
				dct-toolkit get_access_group_by_id access_group_id="<ACCESS_GROUP_ID>" -js

				# Add tag filter to the scope
				dct-toolkit add_tags_to_scope \
				access_group_id="<ACCESS_GROUP_ID>" \
				scope_id="<SCOPE_ID>" \
			tags='Team=Alpha'

The scope restricts permissions to VDBs tagged with Team=Alpha only.

Step 5: Tag VDBs and verify

# Find a VDB to tag
				dct-toolkit get_vdbs --columns=id,name,database_type

				# Tag it for Alpha Team
				dct-toolkit create_vdb_tags vdb_id="<VDB_NAME_OR_ID>" tags='Team=Alpha'

				# Verify the tag
			dct-toolkit get_tags_vdb vdb_id="<VDB_NAME_OR_ID>"

Ongoing management

# Add more users to Alpha Team
				dct-toolkit create_account \
				email=bob.tester@company.com \
				username=bob.tester \
				password="SecurePassword456!" \
				tags='Team=Alpha' \
				--generate_api_key

				# Add more VDBs to Alpha Team access
				dct-toolkit create_vdb_tags vdb_id="<ANOTHER_VDB>" tags='Team=Alpha'

				# View all team members
				dct-toolkit search_accounts tags='Team=Alpha'

				# View all VDBs accessible to the team
			dct-toolkit search_vdbs tags='Team=Alpha' --columns=id,name,tags

Troubleshooting

Issue	Resolution
User can't see any VDBs	Verify the VDB is tagged with Team=Alpha, the user account has the tag Team=Alpha, and the access group scope includes the Team=Alpha tag filter. Use get_tags_vdb, get_account_tags, and get_access_group_scope to check each.