RBAC and the auditor role¶
RBAC is fail-closed, including the vector layer and the SQL path. Enforcement is server-side.
Mutating roles¶
it_admin and app_owner may call mutating admin endpoints from the Operator Console.
Auditor (read-only)¶
| Capability | auditor |
|---|---|
GET admin endpoints |
Allowed |
| Mutations (POST/PUT that change state) | Denied — 403 RES-ADMIN-403 |
Documented so operators do not mis-diagnose a failed button click as a UI bug.
How to verify¶
- Sign in as
auditor. - Load a read view (for example audit trail or connector status) — should succeed.
- Attempt a mutation (create API key, trigger ingestion, change routing, set budgets) — expect 403 /
RES-ADMIN-403.
If it fails¶
| Symptom | Action |
|---|---|
| Auditor can mutate | Unexpected — contact Residion; do not weaken checks |
| Mutating role gets 403 | Check group/role mapping in Keycloak with Residion |