RBAC and Membership
Organization and project roles exposed through Auth Service, and how to manage membership.
Auth Service manages the role and membership information used across the Guardian Platform.
Membership Scope
Organization membership controls organization-level administration. Project membership controls access to project data and project workflows.
Assign broad organization roles only to users who administer the platform. Assign Agent Operator to users who should enroll gateway agents without administering the organization. Assign project roles for normal project work.
Organization Owner already covers every project in the organization, so it cannot be combined with project roles. Auth Service rejects a role list that pairs it with a project role, and rejects project roles for a user who is already an Organization Owner. Granting Organization Owner removes the user’s existing project roles in that organization.
Roles
| Role | Permissions summary |
|---|---|
| Organization Owner | Full organization and project administration, including users, projects, policies, indicators, declarations, reviews, credentials, settings, Governance Programs, and agents (enrollment, revocation, restoration, and reading certifications). |
| Agent Operator | Organization-level. Register gateway agents (register_agents), read the certifications of agents they are bound to (view_agent_certifications), and view project data in every project in the organization. Does not grant agent-to-project association. |
| Project Owner | Project settings, members, applied policies, indicators, declarations, reviews, credentials, project data, and associating agents with the project. |
| Implementation Owner | Create declarations, submit controls for review, run indicators, and view project data. |
| Implementation Contributor | Create declarations, run indicators, and view project data. |
| Audit Owner | Record control outcomes, add review comments, manage credentials, run indicators, and view project data. |
| Audit Contributor | Add review comments, run indicators, and view project data. |
| Project Viewer | View project data only. |
Managing Membership
Guardian is the preferred place for administrators to manage normal project membership. Add users to the projects where they need to work, and assign the least role that supports their responsibilities. Use organization-level access sparingly, because it affects every project.
Integrations that manage membership should follow the same principles as Guardian:
- Preserve the intended organization and project scope.
- Avoid promoting users to broader roles than needed.
- Record who requested the membership change.
- Reconcile access when users leave a team or project.
Use the Auth Service API reference for exact membership request formats.
Troubleshooting Access
If a user can sign in but cannot perform an action, check project membership, role assignment, and whether they are operating in the expected project.
Related
- Roles and Permissions — the full permission matrix in Guardian
- Member Management — adding and removing organization and project members, and changing their roles
- API Keys and Service Accounts — how key scopes narrow these permissions
- Governance Service Authentication and RBAC — how Governance Service applies these roles to projects and activity logs
- Authentication and Authorization Guidelines — least-privilege practices for assigning roles