You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/studio/groups/group-rules.mdx
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,10 +12,10 @@ A **group rule** defines the roles and associated resources that determine what
12
12
13
13
When a group rule doesn't have any explicit resources, the group will always have access to all resources within the organization.
14
14
15
-
In the same way, if a rule is limited to a single resource and that resource is deleted from the organization, the rule will fallback to having access to all resources within the organization.
15
+
In the same way, if a rule is limited to a single resource and that resource is deleted from the organization, the rule will fall back to granting access to all resources in the organization.
16
16
17
17
<Note>
18
-
Unlike limiting resources, if a group doesn't have any rule assigned, this will result in the group effectively not having access to any resource.
18
+
Unlike assigning specific resources, if a group doesn't have any rule assigned, this will result in the group effectively not having access to any resource.
19
19
</Note>
20
20
21
21
## Roles
@@ -26,17 +26,17 @@ You can assign multiple roles to a group using the `Add rule` button. If no grou
Each role can be added only once per group. After assigning a role, you may associate it with multiple resources, but you cannot create additional rules for the same role.
29
+
Each role type can only be added once per group. For example, you can assign the `Organization Admin` and `Organization Viewer` roles in the same group, but you cannot assign the same role type more than once. You could also add a `Graph Admin`role to that group, as long as each role type appears only once.
30
30
31
-
The order in which the roles are assigned to the role doesn't have any effect when performing checks. For example, given the following group:
31
+
The order in which roles are assigned does not affect how access checks are performed. For example, given the following group:
32
32
33
33
<Frame>
34
34
<imgsrc="/images/studio/group-example1.png" />
35
35
</Frame>
36
36
37
37
The members for this group will have **Admin** access to the `default` namespace and **Viewer** to the `test` and any other namespace that may exist in the organization.
38
38
39
-
If the namespace `default` is deleted, the **Admin**would take priority as the limitation no-longer exists.
39
+
If the namespace `default` is deleted, the **Admin**role is no longer scoped and will apply to all resources.
40
40
41
41
With this in mind, members of the following example will have **Organization Admin** access to all resources.
42
42
@@ -53,7 +53,7 @@ These roles apply at the organization level and cannot be limited to specific re
53
53
3.**API Key Manager** — Permissions to create, modify, and delete API keys.
54
54
4.**Viewer** — Read-only access to all organizational objects.
55
55
56
-
An organization **Developer**have access to manage namespaces, create and publish graphs while an **Admin**is able to perform these operations on top of managing the organization settings.
56
+
An organization **Developer**can manage namespacesand publish graphs. An **Admin**can do the same, plus manage organization-wide settings.
57
57
58
58
### Namespace Roles
59
59
@@ -96,7 +96,7 @@ If no subgraph resources are assigned, the group will have access to all subgrap
0 commit comments