L
Lengthy Hare
### Problem
When managing RBAC through account-level user groups (the recommended Terraform-managed approach), the
Organization Access Control: Users
and
Project Access Control: Users
views only display users who have
direct role bindings
at that specific scope.
Users who inherit access through account-level user groups are
completely invisible
in these views, even though they have full functional access.
### Current behavior
  1. Account admin creates user group
    Owner_OrgA
    at account level
  2. Assigns role
    Owner
    + resource group
    RG_OrgA
    (scope: org + child projects) to this group
  3. Adds users Fadi and Karim to
    Owner_OrgA
  4. Fadi and Karim can access OrgA and its projects normally
  5. But
    : navigating to OrgA → Settings → Access Control → Users shows
    0 users
  6. Same issue at project level within OrgA
This creates confusion for org/project owners who see an empty user list despite multiple users having active access.
### Expected behavior
The Org/Project Access Control: Users view should display
all users with effective access
at that scope, including those inheriting permissions through account-level user groups. Ideally with a visual indicator showing the access source (e.g., "via User Group: Owner_OrgA").
### Impact
  • User confusion
    : Org owners think no one has access to their org/projects
  • Audit difficulty
    : Cannot quickly see who has access to a given org/project without checking each user individually at account level or using the Access Policy Analyzer
  • Invite Collaborators dialog
    : The "Collaborators" count on the project card also shows 0, reinforcing the wrong impression
### Workarounds
  • Check each user individually: Account Settings → Users → [user] → Role Bindings → Scope: All
  • Use the Access Policy Analyzer to verify effective permissions per user
Both workarounds are manual and don't scale.
### Environment
  • Harness SaaS, Enterprise edition
  • RBAC managed via Terraform (harness provider >= 0.38.0)
  • Account-level user groups with org-scoped resource groups (INCLUDING_CHILD_SCOPES)
### Additional context
This is a significant UX gap for organizations adopting the "user groups at account level" pattern, which is the recommended approach for scalable RBAC management. The underlying RBAC engine works correctly — the issue is purely in the UI/API responses that filter by direct scope bindings only.