Skip to content

Commit 480badd

Browse files
FayeSGWFayeSGW
authored
Update docs for new Snapshotter role (#709)
1 parent 6a66c1b commit 480badd

2 files changed

Lines changed: 64 additions & 27 deletions

File tree

  • docs.kosli.com/content

‎docs.kosli.com/content/administration/managing_users/roles_in_kosli.md‎

Lines changed: 63 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -15,44 +15,45 @@ Kosli provides three user roles to help administrators manage access and permiss
1515
|------|-------------|----------|
1616
| **Admin** | Full control over the organization | Organization owners, security leads, platform engineering leads |
1717
| **Member** | Can create and modify resources | Developers, platform engineers, CI/CD systems |
18+
| **Snapshotter** | Can create snapshots and modify service accounts | Environment and operations teams |
1819
| **Reader** | Read-only access to view data | Auditors, compliance officers, stakeholders, reporting systems |
1920

2021
## Permissions Matrix
2122

22-
| Capability | Admin | Member | Reader |
23-
|------------|:-----:|:------:|:------:|
23+
| Capability | Admin | Member | Snapshotter | Reader |
24+
|------------|:-----:|:------:|:-----------:|:------:|
2425
| **User Management** | | | |
25-
| Invite and remove users | ✅ | ❌ | ❌ |
26-
| Change user roles | ✅ | ❌ | ❌ |
26+
| Invite and remove users | ✅ | ❌ | ❌ | ❌ |
27+
| Change user roles | ✅ | ❌ | ❌ | ❌ |
2728
| **Organization Settings** | | | |
28-
| Modify organization settings | ✅ | ❌ | ❌ |
29-
| Configure integrations (Slack, LaunchDarkly) | ✅ | ✅ | ❌ |
29+
| Modify organization settings | ✅ | ❌ | ❌ | ❌ |
30+
| Configure integrations (Slack, LaunchDarkly) | ✅ | ✅ | ❌ | ❌ |
3031
| **Service Accounts** | | | |
31-
| Create and manage service accounts | ✅ | ✅ | ❌ |
32-
| Generate service account API keys | ✅ | ✅ | ❌ |
32+
| Create and manage service accounts | ✅ | ✅ | ✅ | ❌ |
33+
| Generate service account API keys | ✅ | ✅ | ✅ | ❌ |
3334
| **Resource Management** | | | |
34-
| Create flows | ✅ | ✅ | ❌ |
35-
| Update/delete flows | ✅ | ✅ | ❌ |
36-
| Create/update environments | ✅ | ✅ | ❌ |
37-
| Delete environments | ✅ | ❌ | ❌ |
38-
| Create/update policies | ✅ | ✅ | ❌ |
39-
| Delete policies | ❌ | ❌ | ❌ |
40-
| Create attestation types | ✅ | ✅ | ❌ |
41-
| Update/delete attestation types | ✅ | ✅ | ❌ |
35+
| Create flows | ✅ | ✅ | ❌ | ❌ |
36+
| Update/delete flows | ✅ | ✅ | ❌ | ❌ |
37+
| Create/update environments | ✅ | ✅ | ❌ | ❌ |
38+
| Delete environments | ✅ | ❌ | ❌ | ❌ |
39+
| Create/update policies | ✅ | ✅ | ❌ | ❌ |
40+
| Delete policies | ❌ | ❌ | ❌ | ❌ |
41+
| Create attestation types | ✅ | ✅ | ❌ | ❌ |
42+
| Update/delete attestation types | ✅ | ✅ | ❌ | ❌ |
4243
| **Attestations & Snapshots** | | | |
43-
| Report attestations | ✅ | ✅ | ❌ |
44-
| Report environment snapshots | ✅ | ✅ | ❌ |
45-
| Create and manage approvals | ✅ | ✅ | ❌ |
44+
| Report attestations | ✅ | ✅ | ❌ | ❌ |
45+
| Report environment snapshots | ✅ | ✅ | ✅ | ❌ |
46+
| Create and manage approvals | ✅ | ✅ | ❌ | ❌ |
4647
| **Actions** | | | |
47-
| Create, update, and delete actions | ✅ | ✅ | ❌ |
48-
| View actions | ✅ | ✅ | ✅ |
48+
| Create, update, and delete actions | ✅ | ✅ | ❌ | ❌ |
49+
| View actions | ✅ | ✅ | ✅ | ✅ |
4950
| **Data Access** | | | |
50-
| View trails and artifacts | ✅ | ✅ | ✅ |
51-
| View attestations | ✅ | ✅ | ✅ |
52-
| View snapshots | ✅ | ✅ | ✅ |
53-
| Query and search data | ✅ | ✅ | ✅ |
54-
| Export and generate reports | ✅ | ✅ | ✅ |
55-
| View flow/policy configurations | ✅ | ✅ | ✅ |
51+
| View trails and artifacts | ✅ | ✅ | ✅ | ✅ |
52+
| View attestations | ✅ | ✅ | ✅ | ✅ |
53+
| View snapshots | ✅ | ✅ | ✅ | ✅ |
54+
| Query and search data | ✅ | ✅ | ✅ | ✅ |
55+
| Export and generate reports | ✅ | ✅ | ✅ | ✅ |
56+
| View flow/policy configurations | ✅ | ✅ | ✅ | ✅ |
5657

5758
---
5859

@@ -115,6 +116,40 @@ Assign the Member role to:
115116

116117
---
117118

119+
---
120+
121+
## Snapshotter
122+
123+
Snapshotters can create environment snapshots and manage service accounts, but cannot manage users, resources or integrations or organization-wide settings.
124+
125+
### Permissions
126+
127+
Snapshotters can:
128+
129+
- **Service Accounts**: Create and manage service accounts and their API keys
130+
- **Snapshots**: Report environment snapshots
131+
- **View Data**: Access trails, artifacts, attestations, and snapshots
132+
- **Query Information**: Search and filter data across flows and environments
133+
- **Generate Reports**: Export and analyze compliance data
134+
- **View Configurations**: See flow definitions, policies, attestation types, and actions (but cannot modify them)
135+
136+
Snapshotterss cannot:
137+
- Create, update, or delete any resources
138+
- Report attestations
139+
- Manage approvals
140+
- Create or manage actions
141+
- Configure integrations
142+
- Invite users or change settings
143+
144+
### When to assign
145+
146+
Assign the Snapshotter role to:
147+
- Environment teams who need to manage runtime environments and report snapshots
148+
- Operations teams responsible for defining compliance policies
149+
- Systems that only need to report environment state without modifying build pipelines
150+
151+
---
152+
118153
## Reader
119154

120155
Readers have read-only access to view data in Kosli without the ability to create or modify resources.
@@ -181,6 +216,7 @@ Periodically review user roles and remove access for team members who no longer
181216

182217
- **Admins**: Focus on governance, security, and organization-wide configuration
183218
- **Members**: Handle day-to-day operations and resource management
219+
- **Snapshotters**: Manage environments and policies without affecting build flows
184220
- **Readers**: Provide visibility without risk of accidental changes
185221

186222
---

‎docs.kosli.com/content/implementation_guide/phase_1/roles_and_responsibilities/_index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ The RACI matrix above describes responsibilities during Kosli implementation. To
6868
Kosli user roles control what actions someone can perform in the Kosli system:
6969
- **Admin**: Full control, including user management and organization settings
7070
- **Member**: Can create and modify resources, manage service accounts, and configure integrations
71+
- **Snapshotters**: Can create snapshots and modify service accounts
7172
- **Reader**: Read-only access to view data and compliance status
7273

7374
For guidance on which Kosli user role to assign based on organizational responsibilities, see [Roles in Kosli]({{< ref "/administration/managing_users/roles_in_kosli" >}}).

0 commit comments

Comments
 (0)