← Back to all posts

Granular permissions for stack dependency management

Introducing dedicated actions for stack dependency management would be a solution for this, such as:

  • STACK_DEPENDENCY_CREATE

  • STACK_DEPENDENCY_DELETE

These could follow the same pattern as existing stack-scoped permissions (e.g. STACK_SCHEDULED_RUN_CREATE), allowing them to be included in custom roles without requiring full admin access.

Workaround
Temporarily bumping the role to the built-in Admin role to unblock the work, but this grants broader permissions than intended and is not a sustainable solution.
Problem
Creating stack dependencies requires admin permission on the stack. Teams using custom sub-admin roles cannot manage stack dependencies without being granted full admin access, which includes undesired org-level and worker pool permissions, violating least-privilege principles.

Please authenticate to join the conversation.

Upvoters
Status

🗑️ Archived

Board

💡 Feature Requests

Tags

Access Control

Date

1 day ago

Subscribe to post

Get notified by email when there are changes.