From be253a50521672fdb354c6e945f932fcc0a5cb4e Mon Sep 17 00:00:00 2001 From: Andrey Kizimenko <87822796+AndreyKizimenko@users.noreply.github.com> Date: Wed, 24 Jun 2026 22:37:03 -0500 Subject: [PATCH] Docs: correct custom variables permissions in RBAC guide (#48210) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What & why The [role-based access guide](https://fleetdm.com/guides/role-based-access) listed custom-variables permissions that don't match what Fleet actually enforces in `server/authz/policy.rego` (the "Secret variables" rules): - **Write** (create/edit/delete) is allowed for global **Admin, Maintainer, and GitOps** only — the guide incorrectly granted it to **Observer, Observer+, and Technician**, and omitted **GitOps**. - **Read** (view) is allowed for **all global roles, including GitOps** — the guide omitted GitOps. This updates the two rows in the global permissions table so they match enforcement (and mirror the existing "queries" rows, which share the same role logic). ### Source of truth `server/authz/policy.rego` — Secret variables: ```rego # Global admins, maintainers, and gitops can write secret variables. subject.global_role == [admin, maintainer, gitops][_] # action == write # Any global user can read secret variables. subject.global_role == [admin, maintainer, gitops, technician, observer_plus, observer][_] # action == read ``` ### Notes - Found during a QA chaos-engineering review (originally reported 2026-03-25): the docs implied read-only roles like Observer could create/edit/delete custom variables, which the UI/API don't allow. - The separate "the RBAC guide calls the Reports page the Query page" terminology cleanup is **not** included here — it overlaps the in-flight Query → Report rename (#41419) and is better handled there. - Docs/article-only change; no `changes/` entry needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) --- articles/role-based-access.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/articles/role-based-access.md b/articles/role-based-access.md index dbb14db1f2..9a82dea003 100644 --- a/articles/role-based-access.md +++ b/articles/role-based-access.md @@ -122,8 +122,8 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | Turn off MDM for specific hosts | | | | ✅ | ✅ | | | Configure Microsoft Entra conditional access integration | | | | | ✅ | | | Add Microsoft Entra tenant | | | | | ✅ | | -| View [custom variables](https://fleetdm.com/docs/rest-api/rest-api#list-custom-variables) | ✅ | ✅ | ✅ | ✅ | ✅ | | -| Create, edit, and delete custom variables | ✅ | ✅ | ✅ | ✅ | ✅ | | +| View [custom variables](https://fleetdm.com/docs/rest-api/rest-api#list-custom-variables) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | +| Create, edit, and delete custom variables | | | | ✅ | ✅ | ✅ | \* Applies only to Fleet Premium