Can you have different permission sets for initial deployment versus ongoing maintenance — rather than a single always-on permission?

QUESTION

Can you have different permission sets for initial deployment versus ongoing maintenance — rather than a single always-on permission?

ANSWER

Yes. Nuon calls these dynamic permissions. You define separate roles: a setup role used only during initial provisioning, a maintenance role with limited read-only access for normal operations, and an optional break-glass role that grants elevated access only when explicitly enabled by the customer. The Nuon Runner is the only entity that ever holds permissions in a customer environment during normal operation. Customers can enable or disable these roles from the customer portal, and in air-gapped installs can revoke runner access entirely.