9 lines
608 B
Markdown
9 lines
608 B
Markdown
|
# RBAC best practices (Sky Lattice blueprint)
|
||
|
|
|
||
|
|
- Prefer functional roles (analyst, loader, engineer) composed from access roles per zone.
|
||
|
|
- Never use `ACCOUNTADMIN` for day-to-day service automation after bootstrap.
|
||
|
|
- Restricted domains: analysts read `marts` by default; `curated` in prod needs override + decision.
|
||
|
|
- Environment isolation: default `database_per_env` unless the customer requires account-per-env (record a decision).
|
||
|
|
- Temporary exceptions must have `expires_on` when possible.
|
||
|
|
- Brownfield: leave legacy roles in `unmanaged` with a decision rather than silently rewriting them on day one.
|