Policy

Fine-grained permission policies for all resource types. Covers policy bindings, principal targeting, permission sets, and built-in system policies.

Overview

Refer to the policy concepts page.

Creating a Policy

Refer to the Create a Policy guide for additional details.

Resource Permissions

Each resource has a set of permissions that can be assigned to a policy.

Expand the dropdown below and click on a resource to view their assignable permissions.

Resources

After clicking on a link, expand the Examples dropdown to view the list.

• Agent
• Audit Context
• Cloud Account
• Domain
• Group
• GVC (Global Virtual Cloud)
• Identity
• Image
• Location
• Org
• Policy
• Quota
• Secret
• Service Account
• User
• Volume Set
• Workload

Permission Model

Granting one permission can grant others with it. A binding therefore usually names a single permission rather than a list.

• manage grants every permission defined for that resource kind.
• edit grants view on every kind that has both.

Beyond those two rules, some kinds grant more. Each row below is what the named permission hands over in addition to itself:

Kind	Permission	Also grants
Secret	edit	view, reveal
Secret	reveal	view
Secret	use	view
Domain	edit	view, use
Domain	use	view
Cloud Account	edit	view, browse
Cloud Account	browse	view
Image	create	pull
Image	pull	view
Agent, Identity, Location	use	view
Audit Context	readAudit, writeAudit	view
Managed Kubernetes	clusterAdmin	view
Org	readLogs	view
Workload, Volume Set	exec	the individual exec.* permissions

edit on a secret grants reveal, which is the plaintext. Someone who can change a secret can also read it. Grant use when a principal only needs to attach the secret to a GVC or workload, and view when it only needs to see that the secret exists.

Implication is applied one level deep, from the permission named in the binding. It is not chained, so each kind’s list above is complete as written.

Built-in Policies

Each org has the following built-in policies for each resource (agent, GVC, etc.):

Policy Name	Description	Target	Permission	Group	Service Account
superusers-RESOURCE	Built-in policy granting full access to the superusers group	All Items	manage	superusers	controlplane
viewers-RESOURCE	Built-in policy granting read-only access to the viewers group	All Items	view	viewers	none

Permissions

The permissions below are used to define policies together with one or more of the four principal types:

Permission	Description	Implies
create	Create new policies
delete	Delete existing policies
edit	Modify existing policies	view
manage	Full access	create, delete, edit, manage, view
view	Read-only view

Access Report

Displays the permissions granted to principals for the policy.

CLI

To view the CLI documentation for policies, see the Policy CLI reference.