Skip to content
Governance Platform

Governance Service Authentication and RBAC

Governance Service relies on Auth Service to validate identity and role permissions. A request can represent a signed-in user, a user API key, or a platform service account depending on the workflow.

Access Model

Section titled “Access Model”

Access is based on project and organization roles. Governance Service checks those roles before allowing users to view projects, apply policies, manage controls, create declarations and reviews, manage indicators, or work with credentials.

Learn more about Roles & Permissions.

Integrator Guidance

Section titled “Integrator Guidance”

Integrations should use API keys or service accounts only when machine access is required. Store credentials in a secrets manager, rotate them regularly, and scope them to the smallest practical set of workflows.

If an integration can authenticate but cannot perform an action, check the project context and assigned role before treating the issue as a service outage.