Role-based access control (RBAC)

October 2024

What’s changing

MK.IO has added enhanced support for team management. Previously, access was managed on an individual basis. Administrators had to add users one-by-one to each MK.IO project, and creating a new project meant adding every user in your account to the project.

With this change, users now belong to teams, and access control is managed at the team level. Upon joining your subscription, users are assigned to the Everyone team, which has basic access rights across all of your projects. When new projects are added, this team will gain access to them. Alongside the Everyone team is an Administrators team, which has additional capability around subscription management and billing. If you never touch this, it will just work. Members of your organization will have access to almost everything, and you can promote administrators if needed.

If you have more complex security requirements, underlying these capabilities is an advanced RBAC implementation comprised of teams, roles, scopes, and rights assignments. These access control primitives can be used to support even the most complicated security requirements.

Who is impacted

This RBAC feature impacts users managing an organization and one or more projects inMK.IO.

Why you would use this / Why it matters

RBAC implementation enables you to precisely determine what level of access to assign to users who have shared access to your account.

Additional details

In MK.IO, nothing belongs to an individual user. Instead, all resources belong to a team where a team is a set containing at least one user. Teams gain access to resources in MK.IO through rights assignment. Rights are defined as a set of capabilities (a role) and a scope (projects, locations, resources) assigned to a specific team. Roles and scopes can be reused across many rights assignments.

As you create new teams, members will still be added to the Everyone team.

Getting started

By default, all users will be in the Everyone team.

You should start by reviewing your Administrators team to ensure you are satisfied with the set of people who have full control over your projects.

Then, you can:

  • Define teams, which are collections of users.
  • Define roles, which are collections of capabilities.
  • Define scopes, which are collections of projects.
  • Assign rights to teams - creating a (team, (role, scope)) association.

Availability & rollout plan

RBAC is available in all regions on October 21st

Role-Based Access Control will be available in all regions starting 10/21. Both authorization models will remain active until 11/17, allowing sufficient time to create teams and assign roles in the new model.

Metering & Pricing

There is no additional charge associated to this feature.