> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/internal-developer-portal/3.0/admin-and-customization/rbac/workflow-rbac.md).

# Workflows RBAC

With the release of **Granular RBAC in IDP 2.0**, you can now control access to **Workflows** in your Harness IDP. This means you can restrict who can **create** and **execute** Workflows across your IDP setup. Workflows can be created at all available scopes: **Account**, **Organization**, or **Project**. To learn more about permissions and scopes, visit the [IDP 2.0 Data Model](/internal-developer-portal/3.0/use-idp/software-catalog/data-model/data-model.md).

{% hint style="info" %}
Workflow access is governed by Workflow permissions only. Ownership by a [Team](/internal-developer-portal/use-idp/software-catalog/teams/overview.md) does not grant access to Workflows, Environments, or Environment Blueprints.
{% endhint %}

### RBAC workflow in Harness IDP <a href="#rbac-workflow-in-harness-idp" id="rbac-workflow-in-harness-idp"></a>

Before configuring RBAC for Workflows, ensure you’ve reviewed the [Scopes](/internal-developer-portal/admin-and-customization/rbac/scopes.md#scopes), [Permissions](/internal-developer-portal/admin-and-customization/rbac/scopes.md#permissions--resources), and [RBAC Components](/internal-developer-portal/admin-and-customization/rbac/scopes.md#rbac-components).

Here’s the step-by-step workflow for configuring RBAC in Harness IDP:

1. Go to your administrative settings and select the scope (**Account**, **Org**, or **Project**) where you want to configure RBAC for Workflows.
2. [Create roles with the required permissions](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md). *For example: If you want to configure RBAC for Workflow creation, ensure the role includes the **Create/Edit (Workflow)** permission.*
3. [Create resource groups](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md) to apply RBAC to a specific set of resources for the principal. *For example: To control Workflow access, ensure the **Workflow** resource is added to the resource group.*
4. [Create user groups](/harness-ai/use-harness-platform/platform-access-control/add-user-groups.md) and [add users](/harness-ai/use-harness-platform/platform-access-control/add-users.md).
5. [Assign roles and resource groups](/harness-ai/use-harness-platform/platform-access-control.md#role-binding) to the user groups or users.
6. If not already configured, [set up authentication](/harness-ai/use-harness-platform/authentication.md).

### Permissions for workflows <a href="#permissions-for-workflows" id="permissions-for-workflows"></a>

The following permissions can be configured for Workflows when creating a custom role:

| **Permission**  | **Description**                                                        |
| --------------- | ---------------------------------------------------------------------- |
| **Create/Edit** | Allows users to create Workflows and modify their configurations.      |
| **View**        | Allows users to view Workflows but not create, modify, or delete them. |
| **Delete**      | Allows users to delete Workflows.                                      |
| **Execute**     | Allows users to execute Workflows.                                     |

These permissions can be configured when [creating or modifying a custom role](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md). Choose the permissions that best suit the access level you want to grant. Go to [Manage Roles](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md) to create or update custom roles.

### Workflow RBAC example <a href="#workflow-rbac-example" id="workflow-rbac-example"></a>

You can access **Administrative Settings** from your Harness UI directly using the sidenavbar.

{% embed url="<https://app.tango.us/app/embed/1dcbc9e9-70f4-49e7-bbec-6a2c94c97ae7>" %}
Create the IDP Catalog Create Role
{% endembed %}

#### Configure RBAC for project-level workflow execution <a href="#configure-rbac-for-project-level-workflow-execution" id="configure-rbac-for-project-level-workflow-execution"></a>

This example walks through configuring RBAC to allow users to execute Workflows at a specific project level.

The configuration includes:

* Default Role: **IDP Workflow Executor** (or optionally, a custom role if needed)
* Custom Resource Group: All Workflow Execute Resources
* Custom User Group: Workflow Execute Users

> Harness now provides a **default system role called `IDP Workflow Executor`** at all scopes. This role includes the necessary `View` and `Execute` permissions for IDP Workflows. You can assign this default role to user groups directly without creating a new one.
>
> However, if you want to define a custom role (e.g., with a different name or additional permissions), follow the steps below.

The **All Workflow Execute Resources** group exists at the **project scope** and grants **Execute** access to all Workflows within that project. The `IDP Workflow Execute` role includes the **Execute** permission for Workflows.

**Step 1: Use or create the IDP workflow execute role**

1. In Harness, navigate to the project where you want to configure RBAC.
2. Go to **Project Settings** → **Roles** under the **Access Control** category.
3. Click **New Role** to create a new role.
4. Name the role **IDP Workflow Execute**. (Description and tags are optional.)
5. Click **Save**.
6. Under **Developer Portal** → **Workflow**, select the **Execute** permission.
7. Click **Apply Changes**.

> Learn more about role creation and permissions: [Manage Roles](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md) | [Permissions Reference](/harness-ai/use-harness-platform/platform-access-control/permissions-reference.md)

***

**Step 2: Create a custom resource group**

1. In the same project, go to **Project Settings** → **Resource Groups** under **Access Control**.
2. Click **New Resource Group**.
3. Name the group **All Workflow Execute Resources**. (Select a color; description and tags are optional.)
4. Click **Save**.
5. For **Resource Scope**, select **Project only**. *(This restricts access to resources within this project only.)*
6. Under **Resources**, select **Specified**, then choose **Workflow**.
7. Click **Save**.

> If you need to allow Workflow execution at a higher scope (Org or Account), configure the role, resource group, and user group at that higher scope. Learn more: [Manage Resource Groups](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md)

***

**Step 3: Create the workflow execute users user group**

1. In the same project, go to **Project Settings** → **User Groups** under **Access Control**.
2. Click **New User Group**.
3. Name the group **Workflow Execute Users**. (Description and tags are optional.)
4. Under **Add Users**, select the users to include.
5. Click **Save**.

> Learn more: [Manage User Groups](/harness-ai/use-harness-platform/platform-access-control/add-user-groups.md) | [Manage Users](/harness-ai/use-harness-platform/platform-access-control/add-users.md)

***

**Step 4: Assign the role and resource group to the user group**

1. In the same project, go to **Project Settings** → **User Groups**.
2. Find the **Workflow Execute Users** group and click **Manage Roles**.
3. Under **Role Bindings**, click **Add**.
4. For **Role**, select **IDP Workflow Execute**.
5. For **Resource Groups**, select **All Workflow Execute Resources**.
6. Click **Apply**.

> Learn more: [Role Binding](/harness-ai/use-harness-platform/platform-access-control.md#role-binding)

***

This configuration grants members of the **Workflow Execute Users** group the ability to **execute Workflows** within the selected **project scope** only. To extend this capability across projects or orgs, configure the role and resource group at the appropriate higher scope (Org or Account).