Catalogs
What this screen is for
Catalogs is a reference screen with two tabs. Algorithms lists the cryptographic algorithms the platform supports, as your tenant may use them, in three views with a detail sheet per algorithm. Tenant Roles lists the permissions and roles of the installation's role catalog, grouped by category. Nothing on this screen changes anything: what you decide is how to look at the algorithm catalog and whether to see it through your tenant's algorithm policy.
Its title, tabs, banners and controls are shown in English whatever language the console is set to. The screen once had a third tab for policy templates; templates are now browsed on the Policies screen only.
What must exist first
The screen is offered to SIMPLE and STANDARD tenants alike. Its navigation entry is shown to a viewer holding the permission to list roles, which every built-in tenant role holds — administrator, access administrator, auditor, key manager and viewer alike — so the entry is shown to all of them.
- The Algorithms tab needs the permission to read your tenant's algorithms; without it the tab reports that the catalog could not be loaded.
- The banner above the algorithms needs the permission to read your tenant's effective policies. Without it the banner names the
DEFAULTtemplate and counts the whole list as operational, whatever policy is really in force. - The Tenant Roles tab needs the permission to list roles; a refusal is shown as No roles found.
Decisions you make here
Choosing how to view the algorithms
Dashboard shows six figures and five charts over the algorithms on screen: how many are simple, composite, post-quantum, recommended and experimental, and their spread by category, operation, NIST security level, family and standard, with a panel per national standards body. Its first card is subtitled Full platform catalog, but on this screen it counts the list after your tenant's policy filter, not the platform's.
Explorer shows one card per algorithm. Catalog groups them by family, with All, Post-Quantum (PQC), Hybrid · Composite and Classical chips, a security-level bar, filters by status, level, operation and standard, and a N of M algorithms count. The chip counts are over the list the server returned, not over the chips you have already applied. Selecting an algorithm in Explorer or Catalog opens its detail; selecting a component inside a composite's detail opens that component.
Applying or lifting the policy filter
The banner reads Filtered by TEMPLATE algorithm policy — N algorithms operational in this tenant, naming the template your tenant applied on the Policies screen. The list the server sends is already filtered by your effective algorithm policy: your own template if you applied one, the deployment's policy otherwise, and the full catalog only when neither exists; a policy that denies all algorithms yields an empty list.
By default the console applies its own copy of the same rule on top of that list, and N is what that copy admits. View all supported lifts only the console's copy: it shows the list as the server filtered it, not the whole platform catalog, and the banner's N does not change. Apply policy filter restores the default.
Reading the role catalog
Tenant Roles shows every row of the installation's role catalog except the service-to-service rows and the platform-category rows: the granular permissions, named admin.…, audit.…, secure.…, stream.… and so on; the built-in composite roles such as TENANT_ADMINISTRATOR; and the custom roles composed on the Tenant Roles screen. The server applies no tenant filter to that read, so the custom roles of every tenant of the installation are listed here, by name, not only your own.
Rows are grouped by category, ADMIN, KEY_MANAGEMENT, SECURE and STREAM first and any other category after, each with its count, and the search box matches the name, the display name and the description. The description is the English one; the console does not translate it.
Two marks the cards were built to show never appear: the System badge, because the console reads a field the server does not send, and the list of a role's permissions, because the catalog read does not include it.
The banner's Scopes assignable to users within this tenant overstates the list: an M2M permission such as secure.encrypt is for cryptographic actors, and a platform-only permission that a tenant administrator holds is refused when composed into a tenant role.
How it relates to other screens
The algorithm policy that filters the Algorithms tab is chosen on the Policies screen, and applying a different template changes this list at once:
The key wizard offers exactly the algorithms the Algorithms tab shows in its default, filtered view: same catalog, same rule.
Custom roles are composed, edited and deleted on the Tenant Roles screen; here they are only listed. Roles are assigned to people on the Team Members screen and permissions to actors on the Cryptographic Actors screen: