diff --git a/docs/documentation/platform/role-based-access-controls.mdx b/docs/documentation/platform/role-based-access-controls.mdx index 6f4bee632..198de29c5 100644 --- a/docs/documentation/platform/role-based-access-controls.mdx +++ b/docs/documentation/platform/role-based-access-controls.mdx @@ -1,8 +1,10 @@ --- title: "Role-based Access Controls" -description: "Infisical's Role-based Acccess Controls enable creating permissions for user and machine identities to restrict the actions that can be undertaken." +description: "Infisical's Role-based Acccess Controls enable creating permissions for user and machine identities to restrict access to resources and the range of actions that can performed." --- +### General access controls + Access Control Policies provide a highly granular declarative way to grant or forbid access to certain resources and operations in Infisical. In general, access controls can be split up across projects and organizations. ### Organization-level access controls @@ -17,13 +19,13 @@ Overall, organization-level access controls are significantly of administrative ### Project-level access controls -By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles has a varying access to various features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode. +By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode. ### Creating custom roles By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for: - Creating superadmin roles, roles specific to SRE engineers, etc. - Restricting access of users to specific secrets, folders, and environments. -- Enbedding these specific roles into [PR Workflow policies] (https://infisical.com/docs/documentation/platform/pr-workflows) +- Embedding these specific roles into [PR Workflow policies](https://infisical.com/docs/documentation/platform/pr-workflows) ![project member custom role](../../images/platform/rbac/project-member-custom-role.png) diff --git a/docs/internals/security.mdx b/docs/internals/security.mdx index 668e86945..180d44ec4 100644 --- a/docs/internals/security.mdx +++ b/docs/internals/security.mdx @@ -135,7 +135,7 @@ Lastly, Infisical enforces strong password requirements according to the guidanc ## Role-based access control (RBAC) -Infisical's RBAC feature enables organization owners and administrators to manage fine-grained access policies for members of their organization in Infisical; with RBAC, administrators can define custom roles with permission sets to be conveniently assigned to other members. +[Infisical's RBAC](https://infisical.com/docs/documentation/platform/role-based-access-controls) feature enables organization owners and administrators to manage fine-grained access policies for members of their organization in Infisical; with RBAC, administrators can define custom roles with permission sets to be conveniently assigned to other members. For example, you can define a role provisioning access to secrets in a specific project and environment in it with read-only permissions; the role can be assigned to members of an organization in Infisical. diff --git a/docs/mint.json b/docs/mint.json index 4be9524ca..6ab1b4624 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -120,6 +120,7 @@ "documentation/platform/token", "documentation/platform/mfa", "documentation/platform/pr-workflows", + "documentation/platform/role-based-access-controls", { "group": "Secret Rotation", "pages": [