Granular feature flag permissions

Custom roles that include feature flag edit also receive the granular feature flag permissions. Existing edit access stays in place.

This feature is in Beta and requires enablement. View all early access features.

What you will learn from this topic

How Harness updates custom roles so that feature flag edit access also includes the granular feature flag permissions, and how accounts can preview granular controls in the UI.

Before you begin

• You need a Harness account with Feature Management & Experimentation (FME).

• You use custom roles that include the feature flag edit permission.

• Go to Harness RBAC for FME for roles and resource groups.

What changes

When this capability is enabled for an account, Harness updates roles that include the feature flag edit permission. Those roles also receive these permissions:

• Create feature flags

• Edit feature flag

• Edit feature flag definition

• Use the feature flag kill switch

• Delete feature flags

The existing feature flag edit permission remains on the role.

Role Builder and UI controls (Beta)

When granular UI controls (FME_FF_EDIT_PERMISSION_SPLIT_UI) are enabled for an account:

• Access Control (Role Builder) displays the five granular permission checkboxes instead of the single broad Edit control.

• Newly created custom roles are authored using granular permissions directly.

• Feature Flag screens gate actions and buttons using granular permission checks.

Migration lock (Beta)

Once an account has transitioned to granular permissions, the migration lock flag (FME_FF_EDIT_PERMISSION_SPLIT_ENFORCE) freezes the background custom role migration worker so it stops periodic rescans for that account.

What does not change

Users who can edit feature flags today can still edit them. This update adds permissions. It does not remove access.