Theory

Updated

October 30, 2026

Theory: Local Users are Passwords; RBAC is Casbin Strings

Creating a login and granting a role are two operations. p lines are permissions; g lines are group membership. Projects scope which repos and clusters an app may use.

Invariants

  1. SSO (Dex) maps external identity into the same RBAC.
  2. Project is a hard sandbox (source repos, destinations).
  3. CLI tokens are users too.
account  +  p, g lines  +  project  =  what you may sync

What can break

  • Admin in policy.csv and SSO both on, conflicting.

How to read this chapter

Creating a user, p/g, verifying grants.