Docs: Explain Organization Policy ViewAll rule and RBAC Search policy combining (#590)

v1.13.x/how-to-guides/admin-guide/roles-policies/authorization.mdx

@@ -51,6 +51,10 @@ Following are some examples of conditions:
 | `matchTeam()` | The user belongs to the team that owns the asset |
 | `hasDomain()` | The user's domain access matches the asset's domain |
 
+RBAC Search supports only some of these conditions. It evaluates `noOwner()`, `isOwner()`, `matchAllTags()`, `matchAnyTag()`, `hasDomain()`, and `inAnyTeam()`, and it ignores `matchTeam()` when it filters search results. Access to the asset itself still honors `matchTeam()`.
+
+To limit search results by team, use `isOwner()`. In search, it also matches assets owned by any team the user belongs to. The `inAnyTeam('<team>')` condition checks only the user's team membership: if the user is in that team, it matches every asset.
+
 Use conditions to assess data assets like Tables, Topics, and Dashboards for specific attributes.
 
 Example: Consider the noOwner() condition when applied to the table **fact_orders**. If this table lacks an assigned owner, then the condition returns **true**. However, if an owner is present, it returns **false**.
@@ -67,9 +71,9 @@ This condition is true only if the asset has no owner and carries both of the li
 
 ### Default Rules
 
-Go to **Settings** > **Policies** > **Organization Policy** to see the two rules that come built in and apply to everyone in your organization.
+Go to **Settings** > **Policies** > **Organization Policy** to see the three rules that come built in and apply to everyone in your organization.
 
-<img src="/public/images/how-to-guides/roles-policies/rules4.png" alt="Organization Policy showing the two default rules" />
+<img src="/public/images/how-to-guides/roles-policies/rules4.png" alt="Organization Policy showing the default rules" />
 
 -  **OrganizationPolicy-NoOwner-Rule**
 
@@ -87,6 +91,12 @@ Go to **Settings** > **Policies** > **Organization Policy** to see the two rules
 
    When a user, who either personally owns a table or is part of the team owning that table logs in, they're granted extensive rights. They can modify all properties of that data asset and access complete information about it.
 
+- **OrganizationPolicy-ViewAll-Rule**
+
+    This rule lets every user view every asset. It has no condition, so it applies to all users and all assets, whether or not they own the asset or belong to its team.
+
+    This is why everyone can find and open any asset in Explore by default. With RBAC Search turned on, this rule still applies. See [Roles Based Access Controls (RBAC) Search](#roles-based-access-controls-rbac-search).
+
 By setting up such default rules, the organization ensures clarity in access control based on ownership status and user roles.
 
 ## Policies
@@ -167,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline
 
 ## Roles Based Access Controls (RBAC) Search
 
-By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search – this ensures users only see assets their role allows them to access.
+By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC Search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. For more information, see [How Search Combines Your Policies](#how-search-combines-your-policies).
 
 To enable or disable this, go to **Settings** > **Preferences** > **Search**.
 
@@ -181,13 +191,29 @@ role gives them access to, which helps with data security and compliance.
 **Permissions apply at the point of discovery** – users can't find or browse
 assets they're not allowed to access, even through search.
 
+### How Search Combines Your Policies
+
+RBAC Search combines the rules from all of a user's policies, including the Organization Policy. An asset shows up in search if at least one allow rule lets the user see it, unless a deny rule blocks it.
+
+Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule.
+
+The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional rule that grants `ViewBasic`, `ViewAll`, or `All` has the same effect. Examples are the policy of the Data Consumer role and a read-only viewer policy that grants `ViewBasic` on tables.
+
+For strict isolation, make sure no policy that applies to the user grants `ViewBasic`, `ViewAll`, or `All` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`.
+
+<Warning>
+`ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to.
+</Warning>
+
 ### Before You Turn It On
 
 **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see.
 
+**Check for unconditional `ViewBasic`, `ViewAll`, and `All` rules**: if you need users to see only some assets, review every policy that applies to them.
+
 **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results.
 
-For a full guide on setting up roles and policies, see [Roles and Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements.
+For a full guide on setting up roles and policies, see [Roles and Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC Search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements.
 
 <Card title="Use Cases: Creating Roles & Policies in OpenMetadata" href="/v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases" >
     Tailor your policies to meet your organizational and team needs.

v1.13.x/how-to-guides/admin-guide/roles-policies/use-cases.mdx

@@ -8,7 +8,9 @@ sidebarTitle: "Use Cases: Roles and Policies"
 
 OpenMetadata includes two default configurations out of the box – the Organization Policy and the Data Consumer role – both designed to encourage open data collaboration across your team.
 
-Keep the Organization Policy in place. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained.
+Keep the Organization Policy in place for open data collaboration. It lets everyone view assets and claim ownership when no owner is assigned, which keeps your catalog healthy and well-maintained.
+
+If you need per-team or per-tenant isolation, the Organization Policy's `OrganizationPolicy-ViewAll-Rule` lets every user see every asset, including in search. For more information, see [How Search Combines Your Policies](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#how-search-combines-your-policies).
 
 For individual teams, tailor your policies to match what each team actually needs. The use cases below show how to handle the most common access control scenarios – from simple service creation to sensitive personally identifiable information (PII) protection.
 
@@ -47,6 +49,10 @@ Create a rule that denies all operations when the user isn't the owner of the as
 
 This rule uses the `isOwner()` and `matchTeam()` conditions together. If neither condition is true for the user, access is denied.
 
+<Note>
+Roles Based Access Controls (RBAC) Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams. For more information, see [Condition](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization#condition).
+</Note>
+
 ### Use Case 4: Protect PII-Tagged Assets and Allow Only Owners to Access Them
 
 **Goal**: Lock down any asset tagged with `PII.Sensitive` so only its owner or owning team can access it.
@@ -57,6 +63,10 @@ Create a rule that denies all operations on a Table when it carries the `PII.Sen
 
 This rule combines `matchAllTags('PII.Sensitive')` with `isOwner()` and `matchTeam()` conditions. All three are evaluated together – if the asset is tagged PII and the user has no ownership claim, access is denied.
 
+<Note>
+RBAC Search ignores `matchTeam()`, so this rule might not hide the asset from Explore results. To control what appears in search, use `isOwner()`, which RBAC Search also applies to the user's teams.
+</Note>
+
 ### Use Case 5: Set Up a Read-Only Viewer Role
 
 **Goal**: Give business stakeholders access to browse the catalog and understand what data exists, without exposing raw data or query history.
@@ -142,6 +152,17 @@ This keeps permissions tight and limits the impact if a role is misconfigured.
 **Tip**: Always review Audit Logs after any break-glass access event. Go to **Settings > Audit Logs** to see a full record of every action taken during the session.
 </Tip>
 
+### Use Case 10: Show Each Team Only the Assets It Owns
+
+**Goal**: Make Explore show users only the assets that they or their team own.
+
+1. Go to **Settings** > **Preferences** > **Search** and turn on RBAC Search.
+2. Go to **Settings** > **Policies** > **Organization Policy** and delete `OrganizationPolicy-ViewAll-Rule`.
+3. Open every other policy that applies to the team, such as the policy of the Data Consumer role and the Read-Only Viewer policy from Use Case 5. In each rule that has no condition, remove `ViewBasic`, `ViewAll`, and `All`, or add a condition such as `isOwner()`.
+4. Sign in as a member of the team and search in Explore. Repeat with a member who has each of the other roles that apply to the team. Confirm that only assets owned by that user or team appear.
+
+`OrganizationPolicy-Owner-Rule` keeps access to owned assets in place.
+
 ## Related Pages
 
 - [Building Blocks of Authorization – Rules, Policies, and Roles](/v1.13.x/how-to-guides/admin-guide/roles-policies/authorization) – how rules, policies, and roles work

v2.0.x/how-to-guides/admin-guide/roles-policies/authorization.mdx

@@ -51,6 +51,10 @@ Following are some examples of conditions:
 | `matchTeam()` | The user belongs to the team that owns the asset |
 | `hasDomain()` | The user's domain access matches the asset's domain |
 
+RBAC Search supports only some of these conditions. It evaluates `noOwner()`, `isOwner()`, `matchAllTags()`, `matchAnyTag()`, `hasDomain()`, and `inAnyTeam()`, and it ignores `matchTeam()` when it filters search results. Access to the asset itself still honors `matchTeam()`.
+
+To limit search results by team, use `isOwner()`. In search, it also matches assets owned by any team the user belongs to. The `inAnyTeam('<team>')` condition checks only the user's team membership: if the user is in that team, it matches every asset.
+
 Use conditions to assess data assets like Tables, Topics, and Dashboards for specific attributes.
 
 Example: Consider the noOwner() condition when applied to the table **fact_orders**. If this table lacks an assigned owner, then the condition returns **true**. However, if an owner is present, it returns **false**.
@@ -67,9 +71,9 @@ This condition is true only if the asset has no owner and carries both of the li
 
 ### Default Rules
 
-Go to **Settings** > **Policies** > **Organization Policy** to see the two rules that come built in and apply to everyone in your organization.
+Go to **Settings** > **Policies** > **Organization Policy** to see the three rules that come built in and apply to everyone in your organization.
 
-<img src="/public/images/how-to-guides/roles-policies/rules4.png" alt="Organization Policy showing the two default rules" />
+<img src="/public/images/how-to-guides/roles-policies/rules4.png" alt="Organization Policy showing the default rules" />
 
 -  **OrganizationPolicy-NoOwner-Rule**
 
@@ -87,6 +91,12 @@ Go to **Settings** > **Policies** > **Organization Policy** to see the two rules
 
    When a user, who either personally owns a table or is part of the team owning that table logs in, they're granted extensive rights. They can modify all properties of that data asset and access complete information about it.
 
+- **OrganizationPolicy-ViewAll-Rule**
+
+    This rule lets every user view every asset. It has no condition, so it applies to all users and all assets, whether or not they own the asset or belong to its team.
+
+    This is why everyone can find and open any asset in Explore by default. With RBAC Search turned on, this rule still applies. See [Roles Based Access Controls (RBAC) Search](#roles-based-access-controls-rbac-search).
+
 By setting up such default rules, the organization ensures clarity in access control based on ownership status and user roles.
 
 ## Policies
@@ -167,7 +177,7 @@ If you have a custom role or policy that grants `EditAll` on `Ingestion Pipeline
 
 ## Roles Based Access Controls (RBAC) Search
 
-By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC search – this ensures users only see assets their role allows them to access.
+By default, every user can search for and find any data asset in OpenMetadata, regardless of whether they have permission to access it. If you want search results to reflect each user's permissions, turn on RBAC Search. Search then shows only the assets that the user's policies allow them to see. The built-in Organization Policy allows everyone to see every asset, so this takes effect only after you change that. For more information, see [How Search Combines Your Policies](#how-search-combines-your-policies).
 
 To enable or disable this, go to **Settings** > **Preferences** > **Search**.
 
@@ -181,13 +191,29 @@ role gives them access to, which helps with data security and compliance.
 **Permissions apply at the point of discovery** – users can't find or browse
 assets they're not allowed to access, even through search.
 
+### How Search Combines Your Policies
+
+RBAC Search combines the rules from all of a user's policies, including the Organization Policy. An asset shows up in search if at least one allow rule lets the user see it, unless a deny rule blocks it.
+
+Search only looks at rules that grant `ViewBasic`, `ViewAll`, or `All`. It skips every other rule.
+
+The Organization Policy includes `OrganizationPolicy-ViewAll-Rule`, which grants `ViewAll` on all resources with no condition. Because of this rule, every user sees every asset in search, even with RBAC Search turned on. A role that grants `ViewAll` only under `isOwner()` doesn't change this. The unconditional rule still shows non-owned assets. Any other policy with an unconditional rule that grants `ViewBasic`, `ViewAll`, or `All` has the same effect. Examples are the policy of the Data Consumer role and a read-only viewer policy that grants `ViewBasic` on tables.
+
+For strict isolation, make sure no policy that applies to the user grants `ViewBasic`, `ViewAll`, or `All` without a condition. To change the Organization Policy, go to **Settings** > **Policies** > **Organization Policy**, and either delete `OrganizationPolicy-ViewAll-Rule` or add a condition such as `isOwner()` to it. OpenMetadata doesn't restore the built-in rules when the server restarts. Owners and owning teams keep access through `OrganizationPolicy-Owner-Rule`.
+
+<Warning>
+`ViewAll` also lets users view an asset's details, not only find it in search. After you remove an unconditional `ViewAll` rule, users can open only the assets that another rule gives them access to.
+</Warning>
+
 ### Before You Turn It On
 
 **Check your roles and policies are fully configured** – make sure every user and team has the right permissions for the assets they need. Incomplete configuration can cause users to lose visibility of assets they should see.
 
+**Check for unconditional `ViewBasic`, `ViewAll`, and `All` rules**: if you need users to see only some assets, review every policy that applies to them.
+
 **Test with real users after enabling** – ask someone from each role to run searches and confirm they're seeing the right results.
 
-For a full guide on setting up roles and policies, see [Roles and Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements.
+For a full guide on setting up roles and policies, see [Roles and Policies](/v2.0.x/how-to-guides/admin-guide/roles-policies). Enabling RBAC Search makes sure OpenMetadata's search aligns with your organization's data governance and access requirements.
 
 <Card title="Use Cases: Creating Roles & Policies in OpenMetadata" href="/v2.0.x/how-to-guides/admin-guide/roles-policies/use-cases" >
     Tailor your policies to meet your organizational and team needs.