Security role grant

Included from Basic tier

A security role grant is one local-lane row of the security-domain roles (the local lane beside the directory lane): it gives security_administrator or auditor to a user (the break-glass flag a person grants) or to a group (the shape the upgrade conversion creates for a group that held a securing prefix), globally or delegated to one project. The auditor role is a read floor: within its scope — the whole estate for a global grant, the project's subtree for a delegation — the holder reads everything, and the floor applies to every list, dashboard and summary exactly as to a direct read (a global auditor's lists span every project; a project auditor's projects join whatever its policies grant). It lifts reads only — no write follows from it — and the Block-all policy still wins over it. The directory lane — a provider group mapped to a role — lives on the identity provider's group mappings, not here. Served by the v2 GitRemotePolicyService (ListSecurityRoleGrants, GrantSecurityRole, RevokeSecurityRole, ConfirmSecurityRoleGrant); every write is audited (api:security_role_grants:create|destroy|confirm) and applies on the next authorisation decision.

A grant the upgrade converted from an upstream securing-prefix rule carries its origin and sits in the review queue until the global security administrator confirms it (keeps the role) or revokes it (removes the row). Converted grants are active from creation, so nobody is locked out on upgrade day; the queue is the post-upgrade verification step (opschain security roles review, the Security administration tab).

SecurityRoleGrant

SecurityRoleGrant is one grant row.

Field	Type	Meaning
converted_from	string	Origin of a converted grant: securing_prefix when the upgrade conversion created it from an upstream securing-prefix rule; empty for a grant a person made.
converted_from_path	string	The node path the securing prefix was held on (empty for the global prefix); set with converted_from.
created_at	timestamp	When the record was created.
groupname	string	The group target's name (target_kind = group).
id	string	The record's identity.
project_code	string	The delegated project's code; empty is a global grant.
review_state	string	Review-queue state of a converted grant: pending until the global security administrator confirms it (confirmed) or revokes it (the row is deleted); empty for a grant a person made.
reviewed_at	timestamp	When the grant was confirmed.
reviewed_by_id	string	The confirming reviewer's user id.
role	string	security_administrator or auditor.
target_kind	string	user or group: what the grant targets.
user_id	string	The user target's id (target_kind = user).
username	string	The user target's username, for display.
widened_from_path	string	Set when the held securing prefix sat below project depth and the grant was widened to the enclosing project: the path held.

Who may change a grant

Granting, revoking and confirming are acts of the global security administrator or a superuser, behind the step-up floor. Listing answers to global security administrators, auditors and superusers. The list narrows with review_state (pending is the review queue) and converted.

Related pages

• opschain docs resources/authorisation_policy — what a security_administrator grant lets its holder write.
• opschain docs resources/git_remote_policy — the other security-domain object the role owns.
• opschain docs cli/security-roles — the grant, revoke and review verbs.
• opschain docs cli/admin-security-convert-policy-admins — the upgrade conversion that creates converted grants.