From 28bb0943050cf076eff189a22b68386dc4035e1e Mon Sep 17 00:00:00 2001 From: kiran Date: Thu, 15 Oct 2026 14:08:14 +0530 Subject: [PATCH 1/4] Docs: Explain Organization Policy ViewAll rule and RBAC Search policy combining (#590) --- .../roles-policies/authorization.mdx | 32 +++++++++++++++++-- .../admin-guide/roles-policies/use-cases.mdx | 23 ++++++++++++- .../roles-policies/authorization.mdx | 32 +++++++++++++++++-- .../admin-guide/roles-policies/use-cases.mdx | 23 ++++++++++++- .../roles-policies/authorization.mdx | 32 +++++++++++++++++-- .../admin-guide/roles-policies/use-cases.mdx | 23 ++++++++++++- 6 files changed, 153 insertions(+), 12 deletions(-) diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 783c7174..8f7f2c57 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -51,6 +51,10 @@ Following are some examples of conditions: | `matchTeam()` | The user belongs to the team that owns the asset | | `hasDomain()` | The user's domain access matches the asset's domain | +RBAC Search supports only some of these conditions. It evaluates `noOwner()`, `isOwner()`, `matchAllTags()`, `matchAnyTag()`, `hasDomain()`, and `inAnyTeam()`, and it ignores `matchTeam()` when it filters search results. Access to the asset itself still honors `matchTeam()`. + +To limit search results by team, use `isOwner()`. In search, it also matches assets owned by any team the user belongs to. The `inAnyTeam('')` condition checks only the user's team membership: if the user is in that team, it matches every asset. + Use conditions to assess data assets like Tables, Topics, and Dashboards for specific attributes. Example: Consider the noOwner() condition when applied to the table **fact_orders**. If this table lacks an assigned owner, then the condition returns **true**. However, if an owner is present, it returns **false**. @@ -67,9 +71,9 @@ This condition is true only if the asset has no owner and carries both of the li ### Default Rules -Go to **Settings** > **Policies** > **Organization Policy** to see the two rules that come built in and apply to everyone in your organization. +Go to **Settings** > **Policies** > **Organization Policy** to see the three rules that come built in and apply to everyone in your organization. -Organization Policy showing the two default rules +Organization Policy showing the default rules - **OrganizationPolicy-NoOwner-Rule** @@ -87,6 +91,12 @@ Go to **Settings** > **Policies** > **Organization Policy** to see the two rules When a user, who either personally owns a table or is part of the team owning that table logs in, they're granted extensive rights. They can modify all properties of that data asset and access complete information about it. +- **OrganizationPolicy-ViewAll-Rule** + + This rule lets every user view every asset. It has no condition, so it applies to all users and all assets, whether or not they own the asset or belong to its team. + + This is why everyone can find and open any asset in Explore by default. With RBAC Search turned on, this rule still applies. See [Roles Based Access Controls (RBAC) Search](#roles-based-access-controls-rbac-search). + By setting up such default rules, the organization ensures clarity in access control based on ownership status and user roles. ## Policies @@ -167,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline ## Roles Based Access Controls (RBAC) Search -By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search – this ensures users only see assets their role allows them to access. +By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. See [How Search Combines Your Policies](#how-search-combines-your-policies). To enable or disable this, go to **Settings** > **Preferences** > **Search**. @@ -181,10 +191,26 @@ role gives them access to, which helps with data security and compliance. **Permissions apply at the point of discovery** – users can't find or browse assets they're not allowed to access, even through search. +### How Search Combines Your Policies + +RBAC Search combines the rules from all of a user's policies, including the Organization Policy. An asset shows up in search if at least one allow rule lets the user see it, unless a deny rule blocks it. + +Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. + +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this: the unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the Data Consumer policy, has the same effect. + +For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. + + +`ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to. + + ### Before You Turn It On **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. +**Check for unconditional `ViewAll` rules** – if you need users to see only some assets, review every policy that applies to them. See [How Search Combines Your Policies](#how-search-combines-your-policies). + **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. For a full guide on setting up roles and policies, see [Roles and Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index ada74b05..ad839aef 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -8,7 +8,9 @@ sidebarTitle: "Use Cases: Roles and Policies" OpenMetadata includes two default configurations out of the box – the Organization Policy and the Data Consumer role – both designed to encourage open data collaboration across your team. -Keep the Organization Policy in place. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. +Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. + +If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For details, see [How Search Combines Your Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection. @@ -47,6 +49,10 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. + +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). + + ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them **Goal**: Lock down any asset tagged with `PII.Sensitive` so only its owner or owning team can access it. @@ -57,6 +63,10 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied. + +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). + + ### Use Case 5: Set Up a Read-Only Viewer Role **Goal**: Give business stakeholders access to browse the catalog and understand what data exists, without exposing raw data or query history. @@ -142,6 +152,17 @@ This keeps permissions tight and limits the impact if a role is misconfigured. **Tip**: Always review Audit Logs after any break-glass access event. Go to **Settings > Audit Logs** to see a full record of every action taken during the session. +### Use Case 10: Show Each Team Only the Assets It Owns + +**Goal**: Make Explore show users only the assets that they or their team own. + +1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. +2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. +3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. +4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. + +`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. For details, see [How Search Combines Your Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). + ## Related Pages - [Building Blocks of Authorization – Rules, Policies, and Roles](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization) – how rules, policies, and roles work diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 53de60cf..e2ce152d 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -51,6 +51,10 @@ Following are some examples of conditions: | `matchTeam()` | The user belongs to the team that owns the asset | | `hasDomain()` | The user's domain access matches the asset's domain | +RBAC Search supports only some of these conditions. It evaluates `noOwner()`, `isOwner()`, `matchAllTags()`, `matchAnyTag()`, `hasDomain()`, and `inAnyTeam()`, and it ignores `matchTeam()` when it filters search results. Access to the asset itself still honors `matchTeam()`. + +To limit search results by team, use `isOwner()`. In search, it also matches assets owned by any team the user belongs to. The `inAnyTeam('')` condition checks only the user's team membership: if the user is in that team, it matches every asset. + Use conditions to assess data assets like Tables, Topics, and Dashboards for specific attributes. Example: Consider the noOwner() condition when applied to the table **fact_orders**. If this table lacks an assigned owner, then the condition returns **true**. However, if an owner is present, it returns **false**. @@ -67,9 +71,9 @@ This condition is true only if the asset has no owner and carries both of the li ### Default Rules -Go to **Settings** > **Policies** > **Organization Policy** to see the two rules that come built in and apply to everyone in your organization. +Go to **Settings** > **Policies** > **Organization Policy** to see the three rules that come built in and apply to everyone in your organization. -Organization Policy showing the two default rules +Organization Policy showing the default rules - **OrganizationPolicy-NoOwner-Rule** @@ -87,6 +91,12 @@ Go to **Settings** > **Policies** > **Organization Policy** to see the two rules When a user, who either personally owns a table or is part of the team owning that table logs in, they're granted extensive rights. They can modify all properties of that data asset and access complete information about it. +- **OrganizationPolicy-ViewAll-Rule** + + This rule lets every user view every asset. It has no condition, so it applies to all users and all assets, whether or not they own the asset or belong to its team. + + This is why everyone can find and open any asset in Explore by default. With RBAC Search turned on, this rule still applies. See [Roles Based Access Controls (RBAC) Search](#roles-based-access-controls-rbac-search). + By setting up such default rules, the organization ensures clarity in access control based on ownership status and user roles. ## Policies @@ -167,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline ## Roles Based Access Controls (RBAC) Search -By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search – this ensures users only see assets their role allows them to access. +By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. See [How Search Combines Your Policies](#how-search-combines-your-policies). To enable or disable this, go to **Settings** > **Preferences** > **Search**. @@ -181,10 +191,26 @@ role gives them access to, which helps with data security and compliance. **Permissions apply at the point of discovery** – users can't find or browse assets they're not allowed to access, even through search. +### How Search Combines Your Policies + +RBAC Search combines the rules from all of a user's policies, including the Organization Policy. An asset shows up in search if at least one allow rule lets the user see it, unless a deny rule blocks it. + +Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. + +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this: the unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the Data Consumer policy, has the same effect. + +For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. + + +`ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to. + + ### Before You Turn It On **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. +**Check for unconditional `ViewAll` rules** – if you need users to see only some assets, review every policy that applies to them. See [How Search Combines Your Policies](#how-search-combines-your-policies). + **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. For a full guide on setting up roles and policies, see [Roles and Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 020ee172..3ba60277 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -8,7 +8,9 @@ sidebarTitle: "Use Cases: Roles and Policies" OpenMetadata includes two default configurations out of the box – the Organization Policy and the Data Consumer role – both designed to encourage open data collaboration across your team. -Keep the Organization Policy in place. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. +Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. + +If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For details, see [How Search Combines Your Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection. @@ -47,6 +49,10 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. + +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). + + ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them **Goal**: Lock down any asset tagged with `PII.Sensitive` so only its owner or owning team can access it. @@ -57,6 +63,10 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied. + +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). + + ### Use Case 5: Set Up a Read-Only Viewer Role **Goal**: Give business stakeholders access to browse the catalog and understand what data exists, without exposing raw data or query history. @@ -142,6 +152,17 @@ This keeps permissions tight and limits the impact if a role is misconfigured. **Tip**: Always review Audit Logs after any break-glass access event. Go to **Settings > Audit Logs** to see a full record of every action taken during the session. +### Use Case 10: Show Each Team Only the Assets It Owns + +**Goal**: Make Explore show users only the assets that they or their team own. + +1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. +2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. +3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. +4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. + +`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. For details, see [How Search Combines Your Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). + ## Related Pages - [Building Blocks of Authorization – Rules, Policies, and Roles](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization) – how rules, policies, and roles work diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx index c554c7fc..7ca125b5 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -51,6 +51,10 @@ Following are some examples of conditions: | `matchTeam()` | The user belongs to the team that owns the asset | | `hasDomain()` | The user's domain access matches the asset's domain | +RBAC Search supports only some of these conditions. It evaluates `noOwner()`, `isOwner()`, `matchAllTags()`, `matchAnyTag()`, `hasDomain()`, and `inAnyTeam()`, and it ignores `matchTeam()` when it filters search results. Access to the asset itself still honors `matchTeam()`. + +To limit search results by team, use `isOwner()`. In search, it also matches assets owned by any team the user belongs to. The `inAnyTeam('')` condition checks only the user's team membership: if the user is in that team, it matches every asset. + Use conditions to assess data assets like Tables, Topics, and Dashboards for specific attributes. Example: Consider the noOwner() condition when applied to the table **fact_orders**. If this table lacks an assigned owner, then the condition returns **true**. However, if an owner is present, it returns **false**. @@ -67,9 +71,9 @@ This condition is true only if the asset has no owner and carries both of the li ### Default Rules -Go to **Settings** > **Policies** > **Organization Policy** to see the two rules that come built in and apply to everyone in your organization. +Go to **Settings** > **Policies** > **Organization Policy** to see the three rules that come built in and apply to everyone in your organization. -Organization Policy showing the two default rules +Organization Policy showing the default rules - **OrganizationPolicy-NoOwner-Rule** @@ -87,6 +91,12 @@ Go to **Settings** > **Policies** > **Organization Policy** to see the two rules When a user, who either personally owns a table or is part of the team owning that table logs in, they're granted extensive rights. They can modify all properties of that data asset and access complete information about it. +- **OrganizationPolicy-ViewAll-Rule** + + This rule lets every user view every asset. It has no condition, so it applies to all users and all assets, whether or not they own the asset or belong to its team. + + This is why everyone can find and open any asset in Explore by default. With RBAC Search turned on, this rule still applies. See [Roles Based Access Controls (RBAC) Search](#roles-based-access-controls-rbac-search). + By setting up such default rules, the organization ensures clarity in access control based on ownership status and user roles. ## Policies @@ -167,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline ## Roles Based Access Controls (RBAC) Search -By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search – this ensures users only see assets their role allows them to access. +By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. See [How Search Combines Your Policies](#how-search-combines-your-policies). To enable or disable this, go to **Settings** > **Preferences** > **Search**. @@ -181,10 +191,26 @@ role gives them access to, which helps with data security and compliance. **Permissions apply at the point of discovery** – users can't find or browse assets they're not allowed to access, even through search. +### How Search Combines Your Policies + +RBAC Search combines the rules from all of a user's policies, including the Organization Policy. An asset shows up in search if at least one allow rule lets the user see it, unless a deny rule blocks it. + +Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. + +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this: the unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the Data Consumer policy, has the same effect. + +For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. + + +`ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to. + + ### Before You Turn It On **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. +**Check for unconditional `ViewAll` rules** – if you need users to see only some assets, review every policy that applies to them. See [How Search Combines Your Policies](#how-search-combines-your-policies). + **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. For a full guide on setting up roles and policies, see [Roles and Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx index ef69e8ea..c7f11f6f 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -8,7 +8,9 @@ sidebarTitle: "Use Cases: Roles and Policies" OpenMetadata includes two default configurations out of the box – the Organization Policy and the Data Consumer role – both designed to encourage open data collaboration across your team. -Keep the Organization Policy in place. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. +Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. + +If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For details, see [How Search Combines Your Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection. @@ -47,6 +49,10 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. + +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). + + ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them **Goal**: Lock down any asset tagged with `PII.Sensitive` so only its owner or owning team can access it. @@ -57,6 +63,10 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied. + +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). + + ### Use Case 5: Set Up a Read-Only Viewer Role **Goal**: Give business stakeholders access to browse the catalog and understand what data exists, without exposing raw data or query history. @@ -142,6 +152,17 @@ This keeps permissions tight and limits the impact if a role is misconfigured. **Tip**: Always review Audit Logs after any break-glass access event. Go to **Settings > Audit Logs** to see a full record of every action taken during the session. +### Use Case 10: Show Each Team Only the Assets It Owns + +**Goal**: Make Explore show users only the assets that they or their team own. + +1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. +2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. +3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. +4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. + +`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. For details, see [How Search Combines Your Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). + ## Related Pages - [Building Blocks of Authorization – Rules, Policies, and Roles](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization) – how rules, policies, and roles work From 393e0bdf060e62fd70997ad3460861d9a99e6ee1 Mon Sep 17 00:00:00 2001 From: kiran Date: Thu, 15 Oct 2026 14:13:46 +0530 Subject: [PATCH 2/4] Docs: Address review findings on ViewAll rule and RBAC Search pages (#590) --- .../admin-guide/roles-policies/authorization.mdx | 6 +++--- .../admin-guide/roles-policies/use-cases.mdx | 8 ++++---- .../admin-guide/roles-policies/authorization.mdx | 6 +++--- .../admin-guide/roles-policies/use-cases.mdx | 8 ++++---- .../admin-guide/roles-policies/authorization.mdx | 6 +++--- .../admin-guide/roles-policies/use-cases.mdx | 8 ++++---- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 8f7f2c57..77054dff 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -177,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline ## Roles Based Access Controls (RBAC) Search -By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. See [How Search Combines Your Policies](#how-search-combines-your-policies). +By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC Search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. For more information, see [How Search Combines Your Policies](#how-search-combines-your-policies). To enable or disable this, go to **Settings** > **Preferences** > **Search**. @@ -209,11 +209,11 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules** – if you need users to see only some assets, review every policy that applies to them. See [How Search Combines Your Policies](#how-search-combines-your-policies). +**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them, as described in How Search Combines Your Policies. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. -For a full guide on setting up roles and policies, see [Roles and Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. +For a full guide on setting up roles and policies, see [Roles and Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC Search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. Tailor your policies to meet your organizational and team needs. diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index ad839aef..b47f8cf1 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -10,7 +10,7 @@ OpenMetadata includes two default configurations out of the box – the Organiza Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. -If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For details, see [How Search Combines Your Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). +If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For more information, see [How Search Combines Your Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection. @@ -50,7 +50,7 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. -RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). +Role-based access control (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them @@ -64,7 +64,7 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied. -RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. ### Use Case 5: Set Up a Read-Only Viewer Role @@ -161,7 +161,7 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. 4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. -`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. For details, see [How Search Combines Your Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). +`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. ## Related Pages diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index e2ce152d..3f00a13f 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -177,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline ## Roles Based Access Controls (RBAC) Search -By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. See [How Search Combines Your Policies](#how-search-combines-your-policies). +By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC Search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. For more information, see [How Search Combines Your Policies](#how-search-combines-your-policies). To enable or disable this, go to **Settings** > **Preferences** > **Search**. @@ -209,11 +209,11 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules** – if you need users to see only some assets, review every policy that applies to them. See [How Search Combines Your Policies](#how-search-combines-your-policies). +**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them, as described in How Search Combines Your Policies. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. -For a full guide on setting up roles and policies, see [Roles and Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. +For a full guide on setting up roles and policies, see [Roles and Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC Search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. Tailor your policies to meet your organizational and team needs. diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 3ba60277..743a0328 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -10,7 +10,7 @@ OpenMetadata includes two default configurations out of the box – the Organiza Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. -If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For details, see [How Search Combines Your Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). +If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For more information, see [How Search Combines Your Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection. @@ -50,7 +50,7 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. -RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). +Role-based access control (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them @@ -64,7 +64,7 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied. -RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. ### Use Case 5: Set Up a Read-Only Viewer Role @@ -161,7 +161,7 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. 4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. -`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. For details, see [How Search Combines Your Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). +`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. ## Related Pages diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx index 7ca125b5..cc5ae864 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -177,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline ## Roles Based Access Controls (RBAC) Search -By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. See [How Search Combines Your Policies](#how-search-combines-your-policies). +By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC Search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. For more information, see [How Search Combines Your Policies](#how-search-combines-your-policies). To enable or disable this, go to **Settings** > **Preferences** > **Search**. @@ -209,11 +209,11 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules** – if you need users to see only some assets, review every policy that applies to them. See [How Search Combines Your Policies](#how-search-combines-your-policies). +**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them, as described in How Search Combines Your Policies. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. -For a full guide on setting up roles and policies, see [Roles and Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. +For a full guide on setting up roles and policies, see [Roles and Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies). Enabling RBAC Search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements. Tailor your policies to meet your organizational and team needs. diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx index c7f11f6f..7f55c29b 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -10,7 +10,7 @@ OpenMetadata includes two default configurations out of the box – the Organiza Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained. -If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For details, see [How Search Combines Your Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). +If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For more information, see [How Search Combines Your Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection. @@ -50,7 +50,7 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. -RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). +Role-based access control (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them @@ -64,7 +64,7 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied. -RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For details, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). +RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. ### Use Case 5: Set Up a Read-Only Viewer Role @@ -161,7 +161,7 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. 4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. -`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. For details, see [How Search Combines Your Policies](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies). +`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. ## Related Pages From 3840ce4a27802f7fb1fcdd6b8ec7019355e20fab Mon Sep 17 00:00:00 2001 From: kiran Date: Thu, 15 Oct 2026 14:16:00 +0530 Subject: [PATCH 3/4] Docs: Address second round of review findings on RBAC Search pages (#590) --- .../admin-guide/roles-policies/authorization.mdx | 4 ++-- .../how-to-guides/admin-guide/roles-policies/use-cases.mdx | 4 ++-- .../admin-guide/roles-policies/authorization.mdx | 4 ++-- v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx | 4 ++-- .../admin-guide/roles-policies/authorization.mdx | 4 ++-- .../how-to-guides/admin-guide/roles-policies/use-cases.mdx | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 77054dff..550bfd7f 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -197,7 +197,7 @@ RBAC Search combines the rules from all of a user's policies, including the Orga Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. -The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this: the unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the Data Consumer policy, has the same effect. +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the policy of the Data Consumer role, has the same effect. For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. @@ -209,7 +209,7 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them, as described in How Search Combines Your Policies. +**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index b47f8cf1..12d93687 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -50,7 +50,7 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. -Role-based access control (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). +Roles Based Access Controls (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition). ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them @@ -158,7 +158,7 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. 2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. -3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. +3. Open every other policy that applies to the team, such as the policy of the Data Consumer role, and remove `ViewAll` from any rule that has no condition. 4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. `OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 3f00a13f..4381b690 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -197,7 +197,7 @@ RBAC Search combines the rules from all of a user's policies, including the Orga Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. -The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this: the unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the Data Consumer policy, has the same effect. +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the policy of the Data Consumer role, has the same effect. For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. @@ -209,7 +209,7 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them, as described in How Search Combines Your Policies. +**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 743a0328..85e87202 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -50,7 +50,7 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. -Role-based access control (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). +Roles Based Access Controls (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization#condition). ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them @@ -158,7 +158,7 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. 2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. -3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. +3. Open every other policy that applies to the team, such as the policy of the Data Consumer role, and remove `ViewAll` from any rule that has no condition. 4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. `OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx index cc5ae864..56f6517b 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -197,7 +197,7 @@ RBAC Search combines the rules from all of a user's policies, including the Orga Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. -The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this: the unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the Data Consumer policy, has the same effect. +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the policy of the Data Consumer role, has the same effect. For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. @@ -209,7 +209,7 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them, as described in How Search Combines Your Policies. +**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 7f55c29b..4e77a8bd 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -50,7 +50,7 @@ Create a rule that denies all operations when the user isn't the owner of the as This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied. -Role-based access control (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). +Roles Based Access Controls (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization#condition). ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them @@ -158,7 +158,7 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. 2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. -3. Open every other policy that applies to the team, such as the Data Consumer policy, and remove `ViewAll` from any rule that has no condition. +3. Open every other policy that applies to the team, such as the policy of the Data Consumer role, and remove `ViewAll` from any rule that has no condition. 4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. `OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. From 8f6bcd62b7308a0f33e41422a4dc0f54d71c5671 Mon Sep 17 00:00:00 2001 From: kiran Date: Thu, 15 Oct 2026 16:40:52 +0530 Subject: [PATCH 4/4] Docs: Cover ViewBasic and All grants in strict isolation guidance (#590) --- .../admin-guide/roles-policies/authorization.mdx | 6 +++--- .../how-to-guides/admin-guide/roles-policies/use-cases.mdx | 4 ++-- .../admin-guide/roles-policies/authorization.mdx | 6 +++--- .../how-to-guides/admin-guide/roles-policies/use-cases.mdx | 4 ++-- .../admin-guide/roles-policies/authorization.mdx | 6 +++--- .../how-to-guides/admin-guide/roles-policies/use-cases.mdx | 4 ++-- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 550bfd7f..4927b07b 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -197,9 +197,9 @@ RBAC Search combines the rules from all of a user's policies, including the Orga Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. -The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the policy of the Data Consumer role, has the same effect. +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional rule that grants `ViewBasic`, `ViewAll`, or `All` has the same effect. Examples are the policy of the Data Consumer role and a read-only viewer policy that grants `ViewBasic` on tables. -For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. +For strict isolation, make sure no policy that applies to the user grants `ViewBasic`, `ViewAll`, or `All` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. `ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to. @@ -209,7 +209,7 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them. +**Check for unconditional `ViewBasic`, `ViewAll`, and `All` rules**: if you need users to see only some assets, review every policy that applies to them. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. diff --git a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 12d93687..2779bb36 100644 --- a/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -158,8 +158,8 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. 2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. -3. Open every other policy that applies to the team, such as the policy of the Data Consumer role, and remove `ViewAll` from any rule that has no condition. -4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. +3. Open every other policy that applies to the team, such as the policy of the Data Consumer role and the Read-Only Viewer policy from Use Case 5. In each rule that has no condition, remove `ViewBasic`, `ViewAll`, and `All`, or add a condition such as `isOwner()`. +4. Sign in as a member of the team and search in Explore. Repeat with a member who has each of the other roles that apply to the team. Confirm that only assets owned by that user or team appear. `OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx index 4381b690..35f4e4eb 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -197,9 +197,9 @@ RBAC Search combines the rules from all of a user's policies, including the Orga Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. -The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the policy of the Data Consumer role, has the same effect. +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional rule that grants `ViewBasic`, `ViewAll`, or `All` has the same effect. Examples are the policy of the Data Consumer role and a read-only viewer policy that grants `ViewBasic` on tables. -For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. +For strict isolation, make sure no policy that applies to the user grants `ViewBasic`, `ViewAll`, or `All` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. `ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to. @@ -209,7 +209,7 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them. +**Check for unconditional `ViewBasic`, `ViewAll`, and `All` rules**: if you need users to see only some assets, review every policy that applies to them. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. diff --git a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 85e87202..afba5465 100644 --- a/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -158,8 +158,8 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. 2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. -3. Open every other policy that applies to the team, such as the policy of the Data Consumer role, and remove `ViewAll` from any rule that has no condition. -4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. +3. Open every other policy that applies to the team, such as the policy of the Data Consumer role and the Read-Only Viewer policy from Use Case 5. In each rule that has no condition, remove `ViewBasic`, `ViewAll`, and `All`, or add a condition such as `isOwner()`. +4. Sign in as a member of the team and search in Explore. Repeat with a member who has each of the other roles that apply to the team. Confirm that only assets owned by that user or team appear. `OrganizationPolicy-Owner-Rule` keeps access to owned assets in place. diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx index 56f6517b..6c8b40d0 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/authorization.mdx @@ -197,9 +197,9 @@ RBAC Search combines the rules from all of a user's policies, including the Orga Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule. -The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional `ViewAll` rule, such as the policy of the Data Consumer role, has the same effect. +The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional rule that grants `ViewBasic`, `ViewAll`, or `All` has the same effect. Examples are the policy of the Data Consumer role and a read-only viewer policy that grants `ViewBasic` on tables. -For strict isolation, make sure no policy that applies to the user grants `ViewAll` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. +For strict isolation, make sure no policy that applies to the user grants `ViewBasic`, `ViewAll`, or `All` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`. `ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to. @@ -209,7 +209,7 @@ For strict isolation, make sure no policy that applies to the user grants `ViewA **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see. -**Check for unconditional `ViewAll` rules**: if you need users to see only some assets, review every policy that applies to them. +**Check for unconditional `ViewBasic`, `ViewAll`, and `All` rules**: if you need users to see only some assets, review every policy that applies to them. **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results. diff --git a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx index 4e77a8bd..030eb772 100644 --- a/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx +++ b/v2.1.x-SNAPSHOT/how-to-guides/admin-guide/roles-policies/use-cases.mdx @@ -158,8 +158,8 @@ This keeps permissions tight and limits the impact if a role is misconfigured. 1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search. 2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`. -3. Open every other policy that applies to the team, such as the policy of the Data Consumer role, and remove `ViewAll` from any rule that has no condition. -4. Sign in as a member of the team and search in Explore. Confirm that only assets owned by that user or team appear. +3. Open every other policy that applies to the team, such as the policy of the Data Consumer role and the Read-Only Viewer policy from Use Case 5. In each rule that has no condition, remove `ViewBasic`, `ViewAll`, and `All`, or add a condition such as `isOwner()`. +4. Sign in as a member of the team and search in Explore. Repeat with a member who has each of the other roles that apply to the team. Confirm that only assets owned by that user or team appear. `OrganizationPolicy-Owner-Rule` keeps access to owned assets in place.