ivd/sky-lattice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3e4f8577bd
sky-lattice/blueprint/templates/customer-repo/.cursor/skills/platform-ops/rbac-best-practices.md
VG 611ad214fe Initial Sky Lattice scaffold: blueprint, platformctl, and docs. 
Encode intent/decision/plan workflow for Snowflake platform delivery so engagements share a durable recipe instead of one-off LLM chats.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-15 01:48:36 -04:00

608 B
Raw Blame History

RBAC best practices (Sky Lattice blueprint)

  • Prefer functional roles (analyst, loader, engineer) composed from access roles per zone.
  • Never use ACCOUNTADMIN for day-to-day service automation after bootstrap.
  • Restricted domains: analysts read marts by default; curated in prod needs override + decision.
  • Environment isolation: default database_per_env unless the customer requires account-per-env (record a decision).
  • Temporary exceptions must have expires_on when possible.
  • Brownfield: leave legacy roles in unmanaged with a decision rather than silently rewriting them on day one.