fleetworks / warden / features / org-scoping
Org-scoped access
Every read is limited to the caller’s organization; roles and a chmod-style Perm mode decide who may change what.
The organization is the tenant boundary. Services, cloud accounts, workspaces, service accounts and webhook endpoints each belong to exactly one, and no read crosses it.
Membership carries one of four ranked roles: org:viewer, org:contributor, org:admin, and ci:agent for automation. A higher role satisfies any check for a lower one.
Each workspace and service also has a Perm mode: view, edit and delete bits for its owner, its group and everyone else. The default is 770, so other callers, anonymous ones included, see nothing until a record is opened up on purpose.
More features
All features →- 01
Workspace records
List, create and update the Terraform Cloud workspaces your organization owns, each mapped to a service, an AWS account and a repo.
- 02
Deterministic config Review
A fixed rule set checks a stored workspace, PAT or webhook endpoint and reports findings with a severity and a stable rule id.
- 03
Scoped API tokens
Machine callers use wl_ PATs that carry an explicit scope list and an optional pin to one resource.