What are Role-Based Permissions?
Role-based permissions (also known as Role-Based Access Control or RBAC) is a security model that restricts system access based on a user’s role within an organization. Instead of assigning permissions to individual users, permissions are assigned to roles, and users are then assigned to appropriate roles based on their job functions.Key Benefits
- Simplified Management: Assign permissions once to a role, then add users to that role rather than managing permissions for each individual user
- Consistency: Ensures all users with the same role have identical access rights
- Scalability: Easy to onboard new team members by assigning them to pre-configured roles
- Security: Follows the principle of least privilege by granting only the permissions necessary for each role
- Audit & Compliance: Simplifies access reviews and compliance reporting by organizing permissions around job functions
How It Works in Corgea
In Corgea, you create Permission Groups that correspond to different roles in your organization (e.g., Admin, Developer, Security Manager). Each Permission Group is assigned a specific set of permissions that define what actions users in that role can perform. Users are then added to one or more Permission Groups, inheriting all permissions from those groups.Permissions are additive - if a user belongs to multiple Permission Groups, they receive all permissions from all groups they are a member of.
Role-Based Permission Recommendations
Based on the permissions defined in the Corgea platform, here’s a recommended permission matrix for different roles.Role Descriptions
Admin
Full system access - can manage all aspects of the platform including company settings, users, permissions, and all security features.
Development Manager
Can manage development teams, users, projects, and view all security issues. Can initiate scans and manage team assignments but cannot modify security policies.
Developer
Read access to issues, scans, policies, and teams. Can initiate scans for their projects but has limited management capabilities. Focus on viewing and understanding security issues in their code.
DevOps
Operational focus with full control over integrations, scheduled scans, agent settings, and PR automation rules. Can manage scans and view issues but cannot modify security policies or delete issues.
Security Manager
Comprehensive security management including all policy controls, SLAs, blocking rules, and user/team management. Cannot delete permission groups or modify company settings.
Security Engineer
Hands-on security role with full control over security issues, policies, scans, and agent settings. Focus on day-to-day security operations but without user/team management responsibilities.
Permission Groups Overview
The following are suggested Permission Groups to setup. Corgea comes with the Admin permission out of the box.Best Practices
- Permission Assignment
- Security Considerations
- Troubleshooting
1
Identify User Roles
Determine the specific roles and responsibilities within your organization (e.g., Security Analyst, Developer, Manager).
2
Map Permissions to Roles
Assign only the minimum required permissions for each role to follow the principle of least privilege.
3
Create Permission Groups
Create permission groups that correspond to organizational roles and assign the appropriate permissions.
4
Assign Users to Groups
Add users to the appropriate permission groups based on their role and responsibilities.