Governance Service Authentication and RBAC

Governance Service relies on Auth Service to validate identity and role permissions. A request can represent a signed-in user, a user API key, or a platform service account depending on the workflow.

Access Model

Access is based on project and organization roles. Governance Service checks those roles before allowing users to view projects, apply policies, manage controls, create declarations and reviews, manage indicators, or work with credentials.

Listing an organization’s projects returns every project to that organization’s owner, and only assigned projects to other members.

An organization’s activity logs, and one member’s activity within it, follow the same rule: the organization’s owner reads every entry, and a member assigned to projects in that organization reads the entries from those projects. A member with no assignment in the organization reads none.

Learn more about Roles & Permissions.

Integrator Guidance

Integrations should use API keys or service accounts only when machine access is required. Store credentials in a secrets manager, rotate them regularly, and scope them to the smallest practical set of workflows.

If an integration can authenticate but cannot perform an action, check the project context and assigned role before treating the issue as a service outage.