Role-Based Access Control
Granular RBAC with custom roles and organizational policies
Least privilege by default. Custom roles where you need them.
Start with sensible built-in roles. Define custom roles with precise permission sets. Scope roles to organizations, projects, or environments. Version-control policies in Git and enforce them platform-wide.
Overview
Role-Based Access Control on VxCloud combines sensible defaults (Owner, Admin, Developer, Viewer, Billing) with unlimited custom roles for precise organizational requirements. Every one of the platform's 500+ permissions can be included or excluded from a role, and roles can be scoped to an organization, a specific project, a specific environment (dev/staging/prod), or a specific resource.
For more complex policies that depend on request-time context — time of day, source IP, resource tags, approval workflow state — we extend RBAC with Attribute-Based Access Control (ABAC) rules evaluated in sub-millisecond time at every policy decision point. All role and policy definitions can be managed through the UI or as code in Git, with standard review workflows, CI tests, and audit trails.
What's included
Production-grade capabilities, ready to enable in your workspace.
Built-in role library
Owner, Admin, Developer, Deployer, Viewer, Billing — sensible defaults covering 90% of team structures.
Unlimited custom roles
Define roles with any combination of 500+ granular permissions. No artificial caps, no per-role licensing.
Multi-level scoping
Scope roles to organization, project, environment, or individual resource. A user can be Admin in dev and Viewer in prod.
ABAC extensions
Layer attribute-based rules on top of RBAC. Restrict by time, IP, tags, approval state, or any custom attribute.
Policy-as-code
Manage roles and policies in Git. Code review on permission changes, CI tests, rollback, and full diff history.
Group mapping
Map IdP groups to roles automatically. IdP group membership drives platform permissions — no drift.
Business outcomes
Measurable impact teams see when they adopt role-based access control.
Granular permissions
Every action in the platform has a dedicated permission, from "view dashboard" to "delete production database."
Version-controlled policies
Permission changes go through pull requests like any other code. No silent privilege escalations.
Policy decision latency
Policy evaluation is in-process and cached. No perceptible latency impact on authenticated requests.
Permission check audit coverage
Every authorization decision is logged with user, permission, resource, and outcome for audit review.
How customers use it
Real scenarios from VxCloud customers across regulated industries and fast-moving teams.
Bank separating production deploy authority from regular engineering
Custom "Production Deployer" role granted only to SREs. Developers can view prod but cannot modify. Segregation of duties enforced.
Hospital with rotating contractor access
IdP group sync grants contractors the "Temporary Support" role, scoped to specific projects with 30-day TTL. Auto-revoked at expiry.
Retailer with on-call rotation needing temporary prod access
ABAC rule elevates on-call engineers to incident-response role during pager assignments. Auto-downgrades when on-call rotation rotates.
Multi-tenant SaaS with customer-facing support team
Custom "Customer Support" role with read-only access to customer workspaces, gated by ticket-ID context. Every access logged for trust reports.
Frequently asked questions
Still have questions? Our enterprise team answers within one business day.
RBAC assigns permissions via roles (static). ABAC evaluates attributes at request time (dynamic). VxCloud uses RBAC as the foundation and layers ABAC for contextual policies like time-of-day restrictions, IP allowlists, or resource-tag requirements.
Related enterprise capabilities
Ready to move forward with Role-Based Access Control?
Talk to our enterprise team — we'll scope your requirements, map the right capabilities, and build a rollout plan tailored to your organization.