[Docs] Document connection/credential access control in environments

[leecalcote]

Notes for Reviewers

Supersedes and closes #1141.

Description

Adds an Access Control for Connections and Credentials section to cloud/concepts/spaces/environments.md, documenting the same topic #1141 set out to cover, but verified directly against the meshery-cloud implementation (server/dao/connection_access.go) rather than written from assumption. Differences from #1141:

• Corrects an accuracy gap: indirect access via Workspace/Team membership is read-only in code (DeleteUserOwnedConnection and credential delete/update explicitly do not honor it) - [Docs] Document connection access control in environments #1141 implied it granted full inherited access, including delete.
• Adds a missing access path: the "View All Organizations" key, which bypasses the ownership/Team checks entirely - present in code, absent from [Docs] Document connection access control in environments #1141.
• Removes an inaccurate claim: [Docs] Document connection access control in environments #1141 stated Designs and Views inherit access through the same Workspace/Team chain as Connections/Credentials. They don't - they're governed by a separate resource-access-mapping ACL table that the Connection/Credential code never touches.
• Addresses the review feedback [Docs] Document connection access control in environments #1141 left unresolved: "User ID" instead of "UserID", and the wordy repeated sentence in the indirect-access bullet.
• Leaves identity-and-security/_index.md untouched. [Docs] Document connection access control in environments #1141 changed one of its bullets from an em-dash to a parenthetical, which its own review flagged as an inconsistency with the rest of the file rather than an improvement, so that edit isn't carried forward here.

Verified locally: npm install && hugo --gc builds cleanly (1604 pages, no broken {{< ref >}} links) and the new section's heading anchor and TOC entry render as expected.

Signed commits

• Yes, I signed my commits.

Summary by CodeRabbit

• Documentation
  • Added guidance on access control for connections and credentials.
  • Clarified direct ownership, workspace/team read-only access, and the “View All Organizations” key bypass.
  • Documented that Designs and Views use separate access mappings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fcd24240-2f76-4730-817f-a144809cd3a2

📥 Commits

Reviewing files that changed from the base of the PR and between 13748b9 and 1df36b9.

📒 Files selected for processing (1)

• content/en/cloud/concepts/spaces/environments.md

---

📝 Walkthrough

Walkthrough

The environment documentation now explains access control for Connections and Credentials through ownership, Workspace or Team membership, and the “View All Organizations” key. It also distinguishes access mappings for Designs and Views.

Changes

Environment access control

Layer / File(s)	Summary
Document connection and credential access content/en/cloud/concepts/spaces/environments.md	Adds access rules for direct ownership, Workspace or Team membership, and the “View All Organizations” key. Documents read/write and read-only permissions, and separates Design and View access mappings.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Mergeability Score: ⚪ Minimal · up to 1df36

This documentation-only change is localized and merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Suggested reviewers: codexraunak

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the documentation change for connection and credential access control.
Linked Issues check	✅ Passed	The PR fulfills issue #1141 by adding the requested access-control section for connections and credentials.
Out of Scope Changes check	✅ Passed	All documented changes support issue #1141 and remain within the stated documentation scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/connection-credential-access-control

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[leecalcote]

Acknowledged - no actionable findings from the automated review.

[github-actions]

🚀 Preview deployment: https://docs.layer5.io/pr-preview/pr-1206/

Note: Preview may take a moment (GitHub Pages deployment in progress). Please wait and refresh. Track deployment here