Users, roles and service principals
Assign human and automation access through groups, roles and scoped permissions.
Vegalake uses scoped permissions for people and automation. Start with the action and resource a consumer needs, then assign that access through a role or group.
Identity and assignment model
| Object | Purpose |
|---|---|
| User | A person who signs in or uses an authorized bearer token. |
| Service principal | A machine identity for automation and integrations. |
| Group | A reusable collection of users and service principals. |
| Role | A reusable set of permissions assigned to identities or groups. |
Assign access
- Identify the action, organization, workspace and resource scope.
- Reuse or create a role containing the required permissions.
- Use a group when several identities share a responsibility.
- Assign the role to the group, user or service principal.
- Verify access using the intended identity and workspace.
- Remove superseded direct grants so assignments remain understandable.
Collection permissions control operations such as listing or creating connections. Instance permissions target one existing resource. Someone can have permission to use a particular cluster without permission to create clusters.
Invitations and membership
Recipients accept or reject organization invitations. Administrators can list, resend or cancel active invitations. After a user joins, assign the workspace and product permissions their work requires.
For password resets, two-factor enrollment and recovery, see account security.
Automation credentials
Use a service principal for an integration or scheduled consumer. Store its API keys in an approved secret system and rotate or delete credentials when the consumer changes. Use the authentication scheme accepted by the operation; API fundamentals explains bearer tokens, API keys and tenant scope.
Give the identity access to each dependency it must use. A flow operator may need permission to run a QuickFlow, use both connections and use its compute environment, without needing to edit those resources.
Diagnose access
Check identity, organization, workspace, resource scope and permission assignments in that order. A hidden action or empty list can reflect missing access. Protected resources may return a not-found response instead of revealing their existence.
See VegaFlow access control and VegaGraph access control for product-specific dependencies and permission APIs.