> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/internal-developer-portal/3.0/admin-and-customization/rbac/catalog-rbac.md).

# Catalog RBAC

With the release of **Granular RBAC in IDP 2.0**, you can now control access to your **Catalog entities**, i.e., you can restrict who can create and view these entities. Catalog entities can be created at all available scopes: **Account**, **Org**, or **Project**. To learn more about entities, permissions, and scopes, visit the [IDP 2.0 Data Model](/internal-developer-portal/3.0/use-idp/software-catalog/data-model/data-model.md).

### RBAC workflow in Harness IDP <a href="#rbac-workflow-in-harness-idp" id="rbac-workflow-in-harness-idp"></a>

Before configuring RBAC for your Catalog entities, ensure you’ve reviewed the documentation on [Scopes](/internal-developer-portal/admin-and-customization/rbac/scopes.md#scopes), [Permissions](/internal-developer-portal/admin-and-customization/rbac/scopes.md#permissions--resources), and different [RBAC Components](/internal-developer-portal/admin-and-customization/rbac/scopes.md#rbac-components).

Here’s the workflow for configuring RBAC in Harness IDP:

1. Go to your administrative settings and select the scope (**Account**, **Org**, or **Project**) at which you want to configure RBAC.
2. [Create roles with the desired permissions](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md#create-a-role). *Example: If you are configuring RBAC for Catalog entity creation, ensure the role has the **Create/Edit (Catalog)** permission enabled.*
3. [Create resource groups](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md#create-a-resource-group) to apply RBAC to a specific set of resources for the principal. *Example: To configure RBAC for Catalog entities, ensure the **Catalog** resource is added to the resource group.*
4. [Create user groups](/harness-ai/use-harness-platform/platform-access-control/add-user-groups.md#create-user-groups-manually) and [add users](/harness-ai/use-harness-platform/platform-access-control/add-users.md).
5. [Assign roles and resource groups](/harness-ai/use-harness-platform/platform-access-control.md#role-binding) to users or user groups.
6. If you haven’t already, [configure authentication](/harness-ai/use-harness-platform/authentication.md).

### Permissions for catalog entities <a href="#permissions-for-catalog-entities" id="permissions-for-catalog-entities"></a>

All core Catalog entities (**Component**, **API**, **Resource**) fall under the **"Catalog"** resource category for RBAC. The following permissions can be configured when creating a custom role:

| **Permission**  | **Description**                                                               |
| --------------- | ----------------------------------------------------------------------------- |
| **Create/Edit** | Allows users to create Catalog entities and modify their configuration.       |
| **View**        | Allows users to view Catalog entities but not create, modify, or delete them. |
| **Delete**      | Allows users to delete Catalog entities.                                      |

These permissions can be configured when [creating a custom role](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md#create-a-role). Select the desired permissions based on the level of access you want to grant. To learn more, go to [Manage Roles](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md).

<img src="https://github.com/user-attachments/assets/28bbaebe-a480-4141-b118-250c45771bc5" alt="Image" width="850">

### Access through team ownership <a href="#access-through-team-ownership" id="access-through-team-ownership"></a>

A user can view, edit, or delete a Catalog entity through a direct Catalog permission at the entity's scope, or through the same permission on the [Team](/internal-developer-portal/use-idp/software-catalog/teams/overview.md) that owns it. Either one is sufficient. However, creating a new entity always requires Catalog Create/Edit permission at the entity's scope and is never inherited from a Team.

Go to [Team access control](/internal-developer-portal/use-idp/software-catalog/teams/team-access-control.md) to configure ownership-based access.

### Catalog RBAC example <a href="#catalog-rbac-example" id="catalog-rbac-example"></a>

#### Configure RBAC for Account-level catalog entity creation <a href="#configure-rbac-for-account-level-catalog-entity-creation" id="configure-rbac-for-account-level-catalog-entity-creation"></a>

This example shows how to configure RBAC to allow full control over Catalog entity creation and modification at the **Account scope** (including all child resources).

In this example, we use:

* A custom role: **IDP Catalog Create**
* *(Optional)* A custom resource group: **All Catalog Create Resources**
* *(Optional)* A custom user group: **Catalog Create Users**

The **All Catalog Create Resources** group exists at the **Account scope** and provides **Create/Edit** access to all Catalog entities across the account, including all organizations and projects. The **IDP Catalog Create** role includes the **Create/Edit** permission for Catalog resources.

You can access **Administrative Settings** from your Harness UI directly using the sidenavbar.

{% embed url="<https://app.tango.us/app/embed/1dcbc9e9-70f4-49e7-bbec-6a2c94c97ae7>" %}
Create the IDP Catalog Create Role
{% endembed %}

***

**Step 1: Create the IDP catalog creator role**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.tango.us/app/embed/d3160dfc-3011-462f-a877-da804d730609>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **Roles** under the **Access Control** section.
2. Click **New Role** to create a new role.
3. Name the role **IDP Catalog Create**. (Optional: Add a description and tags.)
4. Click **Save**.
5. Under **Permissions → Developer Portal**, select:
   * **Catalog** → **Create/Edit**
6. Click **Apply Changes**.
   {% endtab %}
   {% endtabs %}

> Learn more about roles: [Manage roles](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md) | [Permissions reference](/harness-ai/use-harness-platform/platform-access-control/permissions-reference.md)

***

***(Optional)*****&#x20;Step 2: Create a custom resource group**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.tango.us/app/embed/e6962da9-989b-4885-b697-63c265b74d1d>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **Resource Groups** under **Access Control**.
2. Click **New Resource Group**.
3. Name the group **All Catalog Create Resources**. (Optional: Select a color, description, and tags.)
4. Click **Save**.
5. For **Resource Scope**, choose **All (including all Organizations and Projects)**. This grants access to the selected resources across the account, including all orgs and projects. [More on Resource Scopes](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md#scopes-and-refinement)
6. For **Resources**, select **Specified**, and then add **Catalog** from the table.
7. Click **Save**.
   {% endtab %}
   {% endtabs %}

> Learn more: [Manage resource groups](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md)

***

***(Optional)*****&#x20;Step 3: Create the "catalog create users" user group**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.tango.us/app/embed/42821be8-f647-4e2e-8cd1-c057051a3e15>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **User Groups** under **Access Control**.
2. Click **New User Group**.
3. Name the group **Catalog Create Users**. (Optional: Add a description and tags.)
4. Under **Add Users**, select the users to include in this group.\~
5. Click **Save**.
   {% endtab %}
   {% endtabs %}

> Learn more: [Manage user groups](/harness-ai/use-harness-platform/platform-access-control/add-user-groups.md) | [Manage users](/harness-ai/use-harness-platform/platform-access-control/add-users.md)

***

**Step 4: Assign the role and resource group to the user group**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.tango.us/app/embed/cc01bb71-292b-4448-b1b7-9b04bc8a7f9a>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **User Groups**.
2. Find the **Catalog Create Users** group and click **Manage Roles**.
3. Under **Role Bindings**, click **Add**.
4. For **Role**, select **IDP Catalog Create**.
5. For **Resource Group**, select **All Catalog Create Resources**.
6. Click **Apply**.
   {% endtab %}
   {% endtabs %}

> Learn more: [Role binding](/harness-ai/use-harness-platform/platform-access-control.md#role-binding)

This setup configures RBAC so that users in the **Catalog Create Users** group have **Create/Edit** access to Catalog entities at the **Account scope**, as well as within all Organizations and Projects under the account.