Docs: Explain Organization Policy ViewAll rule and RBAC Search policy combining (#590)

[kiran1287]

Fixes #590.

Updated the Roles and Policies pages in v1.13.x, v2.0.x, and v2.1.x-SNAPSHOT.

Changes

authorization.mdx

• Documented all three rules of the Organization Policy, including OrganizationPolicy-ViewAll-Rule.
• Listed which conditions RBAC Search evaluates and noted that it ignores matchTeam(). Explained that isOwner() also covers the user's teams in search, while inAnyTeam() checks only team membership.
• Added a "How Search Combines Your Policies" section: search combines the allow rules of all of a user's policies, so an unconditional ViewAll rule keeps every asset visible even with RBAC Search on. Added the steps for strict isolation and a warning about removing the rule.
• Corrected the RBAC Search intro and added a pre-enable check for unconditional ViewAll rules.

use-cases.mdx

• Qualified the "Keep the Organization Policy in place" advice for per-team and per-tenant isolation.
• Added notes to Use Cases 3 and 4 that RBAC Search ignores matchTeam().
• Added Use Case 10, showing how to make Explore show each team only the assets it owns.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
openmetadata	🟢 Ready	View Preview	Oct 15, 2026, 11:13 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[ayush-shah]

Potential finding on the reviewed commit; please verify the scenario below.

[ayush-shah]

[Potential P2] Remove every unrestricted search grant in the isolation steps

A team member with the Read-Only Viewer policy from Use Case 5 still sees other teams’ assets after following these steps: removing ViewAll leaves that policy’s unconditional ViewBasic grants, and the authorization page says search accepts ViewBasic, ViewAll, and All. Remove or ownership-scope all three operations in this procedure and the corresponding strict-isolation guidance, then verify with a member who has the other roles.

[kiran1287]

Fixed in 8f6bcd6. The strict-isolation guidance and Use Case 10 now cover all three operations that search accepts: ViewBasic, ViewAll, and All. Step 3 tells readers to remove them from any rule that has no condition, or add a condition such as isOwner(), and it names the Read-Only Viewer policy from Use Case 5. Step 4 now says to repeat the test with a member who has each of the other roles on the team. Applied in v1.13.x, v2.0.x, and v2.1.x-SNAPSHOT.

[github-actions]

Review Report

Content type: Documentation
Overall verdict: NEEDS WORK
Reason: Critical=0, Major=1, Minor=1.
Reviewed revision: 8f6bcd6
Findings: Critical=0 Major=1 Minor=1

Issues Found

#	Guideline	Severity	Original text	Suggested change
1	Link wording: introduce full-sentence cross-references with "For more information, see [X]"	Major	"With RBAC Search turned on, this rule still applies. See Roles Based Access Controls (RBAC) Search." (v1.13.x, v2.0.x and v2.1.x-SNAPSHOT authorization.mdx, about line 98)	Replace "See [...]" with "For more information, see Roles Based Access Controls (RBAC) Search."
2	Acronyms on first use: expand unfamiliar abbreviations on first use	Minor	"RBAC Search supports only some of these conditions." (v1.13.x, v2.0.x and v2.1.x-SNAPSHOT authorization.mdx, line 54; also "Default Rules" bullet)	This is the first use of "RBAC" in the changed text. The expansion appears only later, in the "Roles Based Access Controls (RBAC) Search" heading. Write "Roles Based Access Controls (RBAC) Search supports only some of these conditions." and use "RBAC Search" afterward.

_{View job · claude-sonnet-5-5 (high) · full}