Access Control

Coldrune uses deny-by-default access control. Without an explicit rule, users with developer or member roles and all service accounts are denied access.

Who needs ACL rules?

Subject	ACL required?
Org owner	No — full access
Org admin	No — full access
Org developer	Yes
Org member	Yes
Service account	Always
Superadmin	No — bypasses everything

Grant access

coldrune acl grant \
  --org my-org \
  --email alice@example.com \
  --project "api-*" \
  --env "*" \
  --permission write

This gives Alice write access to all environments in any project starting with api-.

For service accounts, use --subject with the service account name:

coldrune acl grant \
  --org my-org \
  --subject ci-deploy \
  --project my-app \
  --env prod \
  --permission write

Pattern syntax

Project and environment patterns support glob-like matching:

Pattern	Matches
*	Everything
api-*	api-backend, api-gateway, api-v2
*-prod	us-prod, eu-prod
api-?	api-1, api-x (single character)
{dev,staging}	dev or staging
api-{v1,v2}	api-v1 or api-v2

Patterns are matched against the actual project or environment name when a secret is accessed.

Permission hierarchy

Level	Allows
read	Get secret values, list keys
write	Everything in read + set and delete secrets
admin	Everything in write + manage ACL rules

Each level includes all permissions below it. Granting write implicitly grants read.

Note

ACL permissions don’t override org role restrictions. A member role user cannot write secrets even with a write ACL rule — they’d need at least the developer org role.

List rules

coldrune acl list --org my-org

Revoke access

# By rule ID
coldrune acl revoke --org my-org --id <rule-id>

# All rules for a subject
coldrune acl revoke --org my-org --subject alice@example.com

Upsert behavior

Granting the same subject + project pattern + env pattern combination updates the existing rule’s permission level instead of creating a duplicate.

REST API

# Grant
curl -X POST http://localhost:7100/api/orgs/my-org/acl \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "subject_type": "user",
    "email": "alice@example.com",
    "project_pattern": "api-*",
    "env_pattern": "*",
    "permission": "write"
  }'

# List
curl http://localhost:7100/api/orgs/my-org/acl \
  -H 'Authorization: Bearer <token>'

# Revoke
curl -X DELETE http://localhost:7100/api/orgs/my-org/acl/<rule-id> \
  -H 'Authorization: Bearer <token>'