> ## Documentation Index
> Fetch the complete documentation index at: https://controlplanecorporation-majid-docs-content-expansion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy

> Fine-grained permission policies for all resource types. Covers policy bindings, principal targeting, permission sets, and built-in system policies.

## Overview

Refer to the [policy concepts](/concepts/access-control) page.

## Creating a Policy

Refer to the [Create a Policy](/guides/policy) guide for additional details.

## Resource Permissions

Each resource has a set of permissions that can be assigned to a policy.

Expand the dropdown below and click on a resource to view their assignable permissions.

<Accordion title="Resources">
  After clicking on a link, expand the `Examples` dropdown to view the list.

  * [Agent](/cli-reference/commands/agent#agent-permissions)
  * [Audit Context](/cli-reference/commands/auditctx#auditctx-permissions)
  * [Cloud Account](/cli-reference/commands/cloudaccount#cloudaccount-permissions)
  * [Domain](/cli-reference/commands/domain#domain-permissions)
  * [Group](/cli-reference/commands/group#group-permissions)
  * [GVC (Global Virtual Cloud)](/cli-reference/commands/gvc#gvc-permissions)
  * [Identity](/cli-reference/commands/identity#identity-permissions)
  * [Image](/cli-reference/commands/image#image-permissions)
  * [Location](/cli-reference/commands/location#location-permissions)
  * [Org](/cli-reference/commands/org#org-permissions)
  * [Policy](/cli-reference/commands/policy#policy-permissions)
  * [Quota](/cli-reference/commands/quota#quota-permissions)
  * [Secret](/cli-reference/commands/secret#secret-permissions)
  * [Service Account](/cli-reference/commands/serviceaccount#serviceaccount-permissions)
  * [User](/cli-reference/commands/user#user-permissions)
  * [Volume Set](/cli-reference/commands/volumeset#volumeset-permissions)
  * [Workload](/cli-reference/commands/workload#workload-permissions)
</Accordion>

## Permission Model

Granting one permission can grant others with it. A binding therefore usually names a single permission rather than a list.

* `manage` grants every permission defined for that resource kind.
* `edit` grants `view` on every kind that has both.

Beyond those two rules, some kinds grant more. Each row below is what the named permission hands over in addition to itself:

| Kind                                                                                        | Permission                | Also grants                         |
| :------------------------------------------------------------------------------------------ | :------------------------ | :---------------------------------- |
| [Secret](/reference/secret)                                                                 | `edit`                    | `view`, `reveal`                    |
| [Secret](/reference/secret)                                                                 | `reveal`                  | `view`                              |
| [Secret](/reference/secret)                                                                 | `use`                     | `view`                              |
| [Domain](/reference/domain)                                                                 | `edit`                    | `view`, `use`                       |
| [Domain](/reference/domain)                                                                 | `use`                     | `view`                              |
| [Cloud Account](/reference/cloudaccount)                                                    | `edit`                    | `view`, `browse`                    |
| [Cloud Account](/reference/cloudaccount)                                                    | `browse`                  | `view`                              |
| [Image](/reference/image)                                                                   | `create`                  | `pull`                              |
| [Image](/reference/image)                                                                   | `pull`                    | `view`                              |
| [Agent](/reference/agent), [Identity](/reference/identity), [Location](/reference/location) | `use`                     | `view`                              |
| [Audit Context](/reference/auditctx)                                                        | `readAudit`, `writeAudit` | `view`                              |
| [Managed Kubernetes](/mk8s/overview)                                                        | `clusterAdmin`            | `view`                              |
| [Org](/reference/org)                                                                       | `readLogs`                | `view`                              |
| [Workload](/reference/workload/general), [Volume Set](/reference/volumeset)                 | `exec`                    | the individual `exec.*` permissions |

<Warning>
  **`edit` on a secret grants `reveal`,** which is the plaintext. Someone who can change a secret can also read it. Grant `use` when a principal only needs to attach the secret to a GVC or workload, and `view` when it only needs to see that the secret exists.
</Warning>

Implication is applied one level deep, from the permission named in the binding. It is not chained, so each kind's list above is complete as written.

## Built-in Policies

Each [org](/reference/org) has the following built-in policies for each resource (agent, GVC, etc.):

| Policy Name         | Description                                                    | Target    | Permission | Group                                          | Service Account                                                     |
| :------------------ | :------------------------------------------------------------- | :-------- | :--------- | :--------------------------------------------- | :------------------------------------------------------------------ |
| superusers-RESOURCE | Built-in policy granting full access to the superusers group   | All Items | manage     | [superusers](/reference/group#built-in-groups) | [controlplane](/reference/serviceaccount#built-in-service-accounts) |
| viewers-RESOURCE    | Built-in policy granting read-only access to the viewers group | All Items | view       | [viewers](/reference/group#built-in-groups)    | none                                                                |

## Permissions

The permissions below are used to define [policies](/reference/policy) together with one or more of the four
[principal types](/concepts/access-control):

| Permission | Description              | Implies                            |
| :--------- | :----------------------- | :--------------------------------- |
| create     | Create new policies      |                                    |
| delete     | Delete existing policies |                                    |
| edit       | Modify existing policies | view                               |
| manage     | Full access              | create, delete, edit, manage, view |
| view       | Read-only view           |                                    |

## Access Report

Displays the permissions granted to principals for the policy.

## CLI

To view the CLI documentation for policies, see the [Policy CLI reference](/cli-reference/commands/policy).