Credentials, Teams & RBAC

Once saved, secret fields become write-only: you can replace them but never read them back, so a stolen UI session cannot leak the value.

A Machine credential holds the SSH username, key and privilege-escalation password jobs use to connect to and become root on hosts.

Every person logging into AWX is a user. Permissions can be granted to a user directly, but that gets unmanageable fast at scale.

A team bundles users together so you grant access once to the group, and adding a new hire is just dropping them onto the team. 👥

Role-based access control grants specific roles on specific objects, so a user only sees and runs exactly what their job requires.

On a job template you can grant the Execute role to run it, or Admin to edit it, keeping operators able to launch but not rewrite jobs.

An organization is the top container holding projects, inventories, teams and credentials, letting one AWX serve many isolated tenants.

RBAC lets you follow least privilege: grant the minimum role needed. Auditors might read job results while never touching credentials.

A user can be given a credential to use in a template without ever being able to view its secret, separating who runs from who knows. 🛡️

Credentials lock secrets away write-only, teams group users, and RBAC grants least-privilege roles per object so people run only what they should. ✅