Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Set up your first organizationUnderstanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifySet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysMobile SDK referenceWeb SDK referenceBackend SDK referenceClient SDK referenceFlag implementation reference
Introduction
Understanding CI workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Monitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate external secret providers
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference

Understanding role-based access control

3 minute read

Role-based access control (RBAC) is the authorization model that governs what users and teams can do in CloudBees Unify. RBAC defines permissions using predefined or custom roles, which are assigned to different scopes such as applications, environments, or combinations of both. Understanding how RBAC works enables administrators to implement secure, scalable access management across their organization.

How RBAC works in CloudBees Unify

RBAC works by assigning roles that contain specific permissions to users and teams. A user can be assigned different roles for different resources, for example, Admin access to one application and read-only access to another. This approach provides fine-grained control while maintaining simplicity for administrators.

Role inheritance and effective access

When users are assigned roles at different organizational levels, their permissions combine to create their effective access. For example, a user might have an Admin role for one application while having an Approver role for specific environments in another application. The system evaluates all role assignments to determine what actions the user can perform in each context.

Scoping and resource boundaries

RBAC permissions apply within specific resource boundaries:

  • Tenant-level: Permissions that affect the entire organization.

  • Application-level: Permissions limited to specific applications and their components.

  • Environment-level: Permissions restricted to particular deployment environments.

  • Component-level: Permissions focused on individual components and their workflows.

This hierarchical scoping ensures that permissions granted at one level don’t inadvertently provide access to unrelated resources.

Permission architecture

The CloudBees Unify permission system is built around a structured approach to authorization that balances security with usability.

Permission categories

Permissions are organized into logical categories that reflect different functional areas of the platform:

  • Tenants: User and team management, organizational structure.

  • Components: Workflow automation, artifacts, logs, and resources.

  • Applications: Application-level configuration and management.

  • Configurations: Environment setup, endpoints, extensions, and properties.

  • Analytics: CI insights and value stream management.

  • Feature management: Feature flags, approvals, custom properties, and target groups.

  • Continuous security: Security findings, risk management, and SLA configuration.

  • Other: Cross-cutting concerns like API tokens, audit logs, and manual approvals.

This categorization helps administrators understand what permissions they’re granting and ensures comprehensive coverage of platform capabilities.

Privilege levels

Each permission operates at one of five privilege levels that define the type of access granted:

  • Read: View and access information without modification capabilities.

  • Create: Generate new entities or resources within the permitted scope.

  • Update: Modify existing entities while preserving their fundamental structure.

  • Delete: Remove entities permanently from the system.

  • Execute: Perform actions or trigger operations.

These privilege levels follow standard CRUD (Create, Read, Update, Delete) patterns with the addition of Execute for operational activities. The granular approach allows administrators to provide exactly the level of access needed for each role.

Predefined versus custom roles

CloudBees Unify provides both predefined roles for common use cases and custom roles for specific organizational needs.

Predefined roles

Three predefined roles cover the most common access patterns:

  • Admin: Full administrative control over all functionality within the assigned scope.

  • Approver: Authority to execute manual approvals for workflows requiring human intervention.

  • User: Read-only access to all functionality within the assigned scope and its sub-resources.

These roles provide immediate usability for standard organizational structures while serving as examples for custom role creation.

Custom roles and least privilege

Custom roles enable organizations to implement the principle of least privilege by providing only the minimum permissions necessary for users to perform their job functions. This approach reduces security risks while ensuring users have the access they need to be productive.

Custom roles are particularly valuable for:

  • Specialized responsibilities: Roles that need specific combinations of permissions.

  • Cross-functional teams: Teams that work across multiple platform areas.

  • Compliance requirements: Organizations that need to demonstrate precise access control.

  • Operational separation: Separating development, staging, and production access.

Integration with organizational structure

RBAC works in conjunction with the organizational hierarchy to provide scalable access management. Permissions can be inherited or overridden at different organizational levels, allowing for both centralized policy and local flexibility.

The access control list (ACL) provides visibility into who has what permissions across the entire tenant, making it possible to audit and manage access as organizations grow and change.

Related pages

Understanding users and teams
Manage users