I'm wondering if the Prefect Cloud permissions are granular enough so that I can allow developers to run existing deployments from the Prefect UI in our production workspace but not create and run their own deployments from their local environment but within the production workspace?

Hey Bryant! Off the bat it sounds like the Runner role may fit the bill. Users with the runner role can only view and and run deployments, but not create/edit/delete them. Otherwise, if you need something a bit more granular, there is a Custom Roles capability which would allow you to make a new role by picking and choosing from a list of permissions.

TYVM thats helpful. I realize I had exactly selected the Runner role for this. But, something about our config mustve prevented it from doing its job. Investigating. TY so much