Enable tag-based RBAC controls for templates and other Harness resources, similar to the existing tag-based RBAC model available for pipelines, to allow granular access control without requiring pre-created resources. Problem Statement: Teams need to grant access to subsets of templates at the same hierarchy level, especially at the account scope, without exposing all templates or requiring platform teams to pre-create them. Current RBAC limitations: Access can only be granted to all templates at a level or to specific existing templates Users cannot create new templates without prior access to a specific template Platform teams must bootstrap empty templates to grant access, creating operational overhead When Terraform manages resource groups, bootstrapping templates outside Terraform causes configuration drift Automating template creation via IDP can also modify resource groups, further increasing drift risk This creates a "chicken-and-egg" problem where users cannot create templates because they lack access, and access cannot be granted without an existing template. Current Workaround Some teams use Policy as Code (OPA) to enforce tag-based governance: Require tags on templates Restrict allowed tag values Map tags to user groups allowed to modify templates While effective, this approach: Moves access control from RBAC to policy enforcement Adds complexity and an additional governance layer Is not consistent with native RBAC behavior Proposed Enhancement: Introduce native tag-based RBAC for templates and other Harness resources, similar to pipelines. Desired Capabilities: Grant permissions based on resource tags rather than specific resource instances Allow users to create templates if they apply permitted tags Restrict modification access to resources with specific tags Apply consistently across Harness services, not just pipelines
