From 1df36b97f7887ec47e80b400a98420b08ef7479a Mon Sep 17 00:00:00 2001 From: Lee Calcote Date: Wed, 12 Aug 2026 22:14:31 -0500 Subject: [PATCH] [Docs] Document connection/credential access control in environments Supersedes PR #1141. Verified the three access paths against the meshery-cloud implementation (server/dao/connection_access.go) rather than documenting them from the PR description alone: - Direct ownership and Workspace/Team indirect access are both real, but indirect access is read-only - it does not confer delete/modify rights, which the original PR did not distinguish. - Adds the "View All Organizations" key override, a third access path that exists in code but was missing from the original PR. - Drops the original PR's claim that Designs and Views inherit access through the same Workspace/Team chain - they use a separate resource-access-mapping mechanism instead. Leaves identity-and-security/_index.md untouched; the original PR's edit there swapped an em-dash for parentheses, which its own review flagged as an inconsistency, not an improvement. Signed-off-by: miacycle <184569369+miacycle@users.noreply.github.com> --- content/en/cloud/concepts/spaces/environments.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/content/en/cloud/concepts/spaces/environments.md b/content/en/cloud/concepts/spaces/environments.md index 255d71f2659..6637461d4f3 100644 --- a/content/en/cloud/concepts/spaces/environments.md +++ b/content/en/cloud/concepts/spaces/environments.md @@ -46,6 +46,16 @@ Credentials in an Environment are the keys to securely authenticate and access m > See "[Credentials](https://docs.meshery.io/concepts/logical/credentials)" in Meshery Docs for more information. +## Access Control for Connections and Credentials + +Access to a Connection — and therefore to its associated Credentials — is granted through any of the following, evaluated independently: + +1. **Direct ownership** — the Connection's owner (User ID) matches the current user's ID. Ownership grants full read and write access, including deleting the Connection and its Credentials. +2. **Indirect access through a shared Workspace** — the Connection is assigned to an Environment linked to a Workspace, and the current user belongs to a Team with access to that Workspace. This grants **read-only** access; Team membership alone does not grant the right to modify or delete the Connection or its Credentials. +3. **The "View All Organizations" key** — a user holding this [key]({{< ref "cloud/concepts/identity-and-security/keys.md" >}}) can access every Connection and Credential across all organizations, bypassing the ownership and Team checks above. + +> Designs and Views are governed by a separate mechanism — resource-access mappings — rather than inheriting through Workspace/Team membership. See [Identity and Security → Security Boundaries]({{< ref "cloud/concepts/identity-and-security/_index.md#security-boundaries" >}}) for how these mechanisms fit together. + ## Example: Orbital Labs Environment Setup The following illustrates how Five and Zara set up multi-cloud environments at Orbital Labs, spanning AWS, GCP, and Azure. See [Meet Five and the Cast]({{< ref "cloud/getting-started/meet-five/_index.md" >}}) for the full seed inventory.