Ability to Restrict Delegate Usage to Specific Projects/Pipelines Across Orgs
long-term
I
Intellectual Finch
Customers would like the ability to restrict a delegate’s usage to a defined set of projects/pipelines, even when those projects span across multiple orgs.
Currently, if a delegate is scoped at the account level, it is technically available for all projects and teams. The only workaround today is to place all projects into a dedicated org and scope the delegate there. This is not feasible when the customer’s setup spans multiple orgs.
Sample Use Case:
Customer has a team that purchased dedicated hardware for CI builds. This hardware should only be used by specific pipelines/projects owned by that team, but their projects span across multiple orgs, so creating a single org to scope the delegate is not an option.
Current Behavior:
Delegates scoped at the account level are available to all projects. No way to enforce restrictions using OPA, RBAC, or other policy mechanisms.
Requested Behavior:
Ability to explicitly restrict which orgs/projects/pipelines can use a delegate, even if the delegate is scoped at the account level.
Log In
A
Abhishek Thamman
Merged in a post:
Restrict account-level delegate usage without explicit permissions
D
Dusk blue Crawdad
I need a feature that allows us to control who can use account-level delegates in specific projects without having to explicitly grant permissions. This would help in managing access more efficiently and prevent unauthorized usage of delegates.
Prateek Mittal
marked this post as
long-term
Prateek Mittal
marked this post as
under review
A
Abhishek Thamman
Hey Dusk blue Crawdad, can we connect over a call to discuss this further?
Thanks,
Abhishek Thamman
A
Abhishek Thamman
Hi Dusk blue Crawdad, thanks for the request. It would be great if you could share the following info:
- How are you achieving this today? What is the friction with the same?
- Are there any concerns with doing this through RBAC?
Alternatively, it would be great if you could share some time slots to chat about this requirement.
Thanks,
Abhishek Thamman