6.13.2.30 MoonitoringPredefinedRoleEnum
6.13.2.30.1 Purpose¶
The predefined staff roles, each with a stable key and the explicit list of capabilities it holds. Staff roles carry the key; each one covers one kind of work, so that who grants access is not who works on the data.
Administrators hold every capability only so that they can grant the others; they are named by a job of access, never through an operation.
6.13.2.30.2 Values¶
| Value | Description |
|---|---|
administrators |
Administrators: every capability of MoonitoringCapabilityEnum. Given only by the job access-bootstrap-admin, to two people, never through an operation; it is for granting the other roles, not for daily work. |
support |
Support: access.organizations.read, access.organizations.approve, farm.ingestion.read_all, farm.data_issues.read_all, farm.integration_gaps.read, farm.sync_clients.read_all, releases.installations.read, ai-gateway.usage.read, status.incidents.read.No animal data. |
data_operations |
Data operations: the capabilities of Support, and farm.source_origins.manage, farm.source_adapters.manage, farm.adapter_mappings.manage, farm.integration_gaps.manage, farm.parse_jobs.manage, farm.reconciliation_rules.manage, farm.reference_data.manage, farm.sync_clients.manage_all. |
releases |
Releases: releases.releases.read, releases.installations.read, releases.release_catalog.manage, releases.channels.manage, releases.builds.upload, releases.builds.revoke, releases.releases.stage, releases.releases.approve, releases.releases.pause, releases.releases.rollback.The same role for who stages and who approves: releases refuses the approval of whoever staged the release or built it, so two people are always needed. Signing keys and purges stay with Administrators. |
account |
Account: access.organizations.read, access.organizations.approve, farm.entitlements.manage. |
privacy |
Privacy: access.audit.read, farm.erasure_requests.manage, access.organizations.close.Held by few, with a second approver in prod. |
incident |
Incident: status.incidents.read, status.incidents.manage, status.components.manage. |
news_editor |
News editor: news.articles.write. |
news_publisher |
News publisher: news.articles.write, news.articles.publish. |
grant_curator |
Grant curator: grant.calls.manage, grant.sources.manage.The documents of farmers are not part of it ( grant.documents.read_all). |
ml |
ML: ai-model-platform.datasets.read, ai-model-platform.datasets.manage, ai-model-platform.models.read, ai-model-platform.models.manage.Identified data is read only by service accounts (MoonitoringServiceAccount). |
agents |
Agents: moochat.agents.manage, moochat.agent_models.manage, ai-gateway.usage.read. |
6.13.2.30.3 Relationships¶
Used by
6.13.2.30.4 Rules & constraints¶
- The keys of the predefined staff roles (
MoonitoringRoleAccessControl.key), with their capabilities. Administrators ranks above every other one: priority 1000 for Administrators, 500 for each of the others.