Skip to main content

​
Overview

Refer to the policy concepts page.

​
Creating a Policy

Refer to the Create a Policy guide for additional details.

​
Resource Permissions

Each resource has a set of permissions that can be assigned to a policy. Expand the dropdown below and click on a resource to view their assignable permissions.

​
Permission Model

Granting one permission can grant others with it. A binding therefore usually names a single permission rather than a list.
  • manage grants every permission defined for that resource kind.
  • edit grants view on every kind that has both.
Beyond those two rules, some kinds grant more. Each row below is what the named permission hands over in addition to itself:
edit on a secret grants reveal, which is the plaintext. Someone who can change a secret can also read it. Grant use when a principal only needs to attach the secret to a GVC or workload, and view when it only needs to see that the secret exists.
Implication is applied one level deep, from the permission named in the binding. It is not chained, so each kind’s list above is complete as written.

​
Built-in Policies

Each org has the following built-in policies for each resource (agent, GVC, etc.):

​
Permissions

The permissions below are used to define policies together with one or more of the four principal types:

​
Access Report

Displays the permissions granted to principals for the policy.

​
CLI

To view the CLI documentation for policies, see the Policy CLI reference.