docs: improve rbac and permissions readability #6443
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
|
Kindly check the linting failure: |
Holmus
force-pushed
the
docs/clarify-rbac
branch
from
d98dc42 to
bdf75ee
Compare
matthewelwell
left a comment
matthewelwell
left a comment
There was a problem hiding this comment.
On the whole, this seems like a great improvement. I've added a few minor suggestions and one question, but nothing that is strictly necessary I don't think.
| R -->|Assigned to| A[Admin API keys]; | ||
| G -->|Contains many| U; | ||
| ``` | ||
| Permissions are granted to **roles**, and roles are assigned to users, groups, or Admin API keys. A user's effective permissions are the **union of all permissions** from every role assigned to them — both directly and through group membership. |
There was a problem hiding this comment.
Minor suggestion - should we add links to relevant documentation sections for groups and Admin API Keys (and users if applicable, but I'm not sure we have any documentation on users as such)?
There was a problem hiding this comment.
How did you generate these images, where are the originals?
| - _Organisation Administrator_ grants full access to everything in your Flagsmith organisation. | ||
| - _User_ grants no access and requires you to assign permissions using custom roles and/or groups. | ||
| - An _Organisation User_ (no organisation-wide admin access) | ||
| - A _Project Administrator_ for _Mobile App_ (full control of that project) |
There was a problem hiding this comment.
| - A _Project Administrator_ for _Mobile App_ (full control of that project) | |
| - A _Project Administrator_ for _Mobile App_ (full control of that project and all its environments) |
| - _User_ grants no access and requires you to assign permissions using custom roles and/or groups. | ||
| - An _Organisation User_ (no organisation-wide admin access) | ||
| - A _Project Administrator_ for _Mobile App_ (full control of that project) | ||
| - An _Environment Administrator_ for _Production_ in _Web App_ (full control of just that environment) |
There was a problem hiding this comment.
| - An _Environment Administrator_ for _Production_ in _Web App_ (full control of just that environment) | |
| - An _Environment Administrator_ for _Development_ in _Web App_ (full control of just that environment) |
A bit nit picky, but it seems odd that someone would be an admin for just the Production environment.
| 2. Create a custom role called _Developer Access_ with these permissions: | ||
| - **Project-level**: View project, Create feature | ||
| - **Development environment**: Administrator | ||
| - **Staging environment**: Administrator | ||
| - **Production environment**: View environment, Create change request |
There was a problem hiding this comment.
While this is probably a pretty pragmatic approach, I think a strict separation of roles would probably result in something like the following three roles:
Non-prod Admin Role
Production Change Proposal Role
Base Project Access Role
I don't think we really need to change it for now though.
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature!Changes
How did you test this code?
Ran docs locally, verified SVGs look good, that links work, that the text makes sense and that the general order concepts are presented in makes sense.