Document additive behavior of policies in Restricted API Access #480
Conversation
Adds documentation explaining that when multiple policies apply to the same Service Account, permissions are additive (union of all granted permissions). Fixes authzed#360
|
@ivanauth is attempting to deploy a commit to the authzed Team on Vercel. A member of the Team first needs to authorize it. |
vroldanbet
left a comment
vroldanbet
left a comment
There was a problem hiding this comment.
LGTM, please addres CI build errors
ivanauth
force-pushed
the
fix/issue-360-policy-additivity
branch
from
3233055 to
0547981
Compare
|
@vroldanbet done, thank you. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@ivanauth I re-ran the failed jobs, can you address the errors? |
|
@vroldanbet thank you. The Link Checker failure is pre-existing on the The errors are:
All other checks pass (Lint, Spellcheck, Signature, Vercel Deploy). Happy to fix these pre-existing issues in this PR or a separate one if you'd like - just let me know! |
vroldanbet
left a comment
vroldanbet
left a comment
There was a problem hiding this comment.
Thanks for the context, @ivanauth. Sounds like those errors predate this PR; no reason to block because of them. LGTM!
|
Awesome, thank you @vroldanbet! |
2 participants
Description
Adds documentation explaining that policies in Restricted API Access are additive. When multiple policies apply to the same Service Account, the resulting permissions are the union of all permissions granted by those policies.
This behavior isn't immediately obvious to users, so having it explicitly documented helps avoid confusion when configuring multiple policies for a single Service Account.
Fixes #360