All 29 RBAC questions
More in RBAC
How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)? How do you troubleshoot 'permission denied' errors in ArgoCD? How does the scopes setting affect group mapping? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely? How do you separate duties between who can create apps and who can sync them? How do you enforce that only signed/approved commits get deployed?
Advertisement
ArgoCD › RBAC

How do project roles and tokens enable least-privilege automation?

Advanced

Answer

AppProject roles define scoped policies for that project, and you generate JWT tokens bound to a role. CI uses such a token to, say, sync only that project's apps—no admin account needed. This confines automation to exactly the actions and objects it requires.
roles:
  - name: deployer
    policies: [ 'p, proj:team-a:deployer, applications, sync, team-a/*, allow' ]
Real-world example The pipeline's project-scoped token can sync team-a apps only, never affecting other projects.

Common follow-ups: How is a project token scoped? | Why not use an admin token for CI?

Applications Multi-cluster RBAC
All 29 RBAC questions