RBAC built for runbook-level control
From a single user who only sees Runbook X, to multi-org enterprise licences with central governance - one model, no add-ons.
Five things you can scope
Per runbook
User A sees Runbook X and Y only. Everything else is invisible.
Per environment
Prod requires approval; Dev runs unattended.
Per action
View, Run, Approve, Edit and Delete are independent grants.
Per cloud account / target
Team A can target AWS-prod-eu only - never Azure or another account.
Per time window
Out-of-hours runs require two approvers; weekday runs do not.
Built-in roles + custom overlay
Owner
Billing, members, every runbook, every setting.
Admin
Manage runbooks, members and approval policies. No billing.
Member
Run assigned runbooks, raise approvals, view evidence.
Custom per-runbook ACL
Overlay specific runbooks (and their actions) on top of any role. Optional expiry.
Worked examples
Locum engineer
Member role + per-runbook ACL on Runbook X with a 14-day expiry. Cannot see anything else.
External auditor
Read-only across the evidence vault and DR certificates. No runbook access, no run buttons.
Tier-1 ops
Run on a tagged set of runbooks. Destructive steps trigger an approval gate to a senior engineer.
Multi-org licensing
Single tenant
One organisation
One org, one billing relationship. Members, runbooks and evidence in a single tenant.
Federated tenants
Group of business units
Separate tenants per business unit, central super-admin, cross-tenant reporting and consolidated billing.
Parent-org / MSP
Manage client tenants
Operate runbooks across client tenants from a parent org. Ring-fenced billing and access boundaries per client.
How it's enforced
Postgres RLS
Tenant isolation enforced at the database. Every query is filtered before a row leaves Postgres.
has_role() security definer
Role checks run inside a security-definer function. No client-side trust, no role spoofing.
Append-only audit log
Every permission change and access decision is written to an append-only audit log per tenant.
Enforced two-factor
Authenticator-app MFA is required by default, limited to one device per user, and only a tenant owner or admin can reset or exempt it.
Single tenant vs separate tenants
RBAC handles it
- Team A sees only their runbooks
- Contractors with 14-day expiry
- Prod needs approval; dev does not
- Read-only auditors
Hard boundaries required
- Separate legal entity with its own contract
- Data residency (EU data must not touch US infra)
- Divestiture / M&A (sell the unit, export the tenant)
- MSP managing clients with ring-fenced billing
Talk to us about RBAC for your org
We'll map your role hierarchy, runbook visibility rules and approval policies in a single working session.