Granular Access Policies & Scope Enforcement
Configure declarative access policies using the Deny-Overrides-Allow evaluation model, restrict service account scopes, and safeguard production secrets against unauthorized extraction.
1. Service Account Scope Hierarchy
read
Read-Only Scope
Allows fetching decrypted secrets, listing project environments, and inspecting version histories.
write
Write / Mutation Scope
Includes read scope plus creating, modifying, rolling back, archiving, and bulk upserting secrets.
admin
Admin Scope
Full control over access policies, service account credential generation, key rotation, and bulk secret export.
2. Deny-Overrides-Allow Evaluation Logic
Every request to /v1/secrets is processed by smw.RequireAccessPolicy. Policies are evaluated against the caller's identity, IP address, and requested action:
- Explicit Deny Check: If any matching policy specifies
effect: "DENY", access is rejected immediately (403 Forbidden). - Explicit Allow Check: If an allow rule matches the caller and target path, access is granted.
- Baseline Tenant Gate: If no explicit custom policies exist on the project, baseline tenant membership applies (fail-open within tenant boundaries).