> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/internal-developer-portal/admin-and-customization/rbac/rbac.md).

# Get Started with RBAC

### RBAC in IDP 2.0 <a href="#rbac-in-idp-20" id="rbac-in-idp-20"></a>

**Harness IDP 2.0** introduces **granular RBAC** across various IDP resources such as Catalog and Workflows. This means you now have precise control over **who can view or edit** your IDP resources. RBAC enables administrators to define **what actions users can perform** on specific resources, with scope-aware permissions aligned with **Harness Projects, Organizations, and Accounts**.

Harness IDP leverages the **platform hierarchy** and applies the same access control model as **Platform RBAC**. To learn more, visit the [RBAC in Harness](/harness-ai/use-harness-platform/platform-access-control.md) documentation.

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Before configuring RBAC in Harness IDP:

* You must be an **Admin** at the **Account**, **Organization**, or **Project** scope.
* For newly created accounts, contact **Harness Support** to provision the first admin.

If you are not an admin, you may still configure certain RBAC settings if you have the required granular permissions:

| **Feature**     | **Required Permissions**  |
| --------------- | ------------------------- |
| Users           | View, Manage, Invite      |
| User Groups     | View, Manage              |
| Resource Groups | View, Create/Edit, Delete |
| Roles           | View, Create/Edit, Delete |

Also, ensure you understand the following concepts:

* [Scopes, Roles & Permissions](/internal-developer-portal/admin-and-customization/rbac/scopes.md)
* [Key Concepts of Harness Platform Hierarchy](/harness-ai/use-harness-platform/platform-access-control.md)
* [Harness IDP RBAC Components](/internal-developer-portal/admin-and-customization/rbac/scopes.md#rbac-components)
* [Catalog RBAC](/internal-developer-portal/admin-and-customization/rbac/catalog-rbac.md) & [Workflow RBAC](/internal-developer-portal/admin-and-customization/rbac/workflow-rbac.md) Principles

### RBAC configuration workflow <a href="#rbac-configuration-workflow" id="rbac-configuration-workflow"></a>

To configure RBAC in Harness IDP, follow these steps:

1. Go to **Account**, **Organization**, or **Project Settings** where you want to apply RBAC.
2. [Create roles with desired permissions](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md).
3. (Optional) [Create resource groups to control access over certain resources](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md) to control access over specific resources.
4. [Create user groups](/harness-ai/use-harness-platform/platform-access-control/add-user-groups.md) and [add users](/harness-ai/use-harness-platform/platform-access-control/add-users.md).
5. [Assign roles and resource groups](/harness-ai/use-harness-platform/platform-access-control.md#role-binding) to users or user groups.
6. (Optional) [Configure authentication](/harness-ai/use-harness-platform/authentication.md), if not already done.

***

### Permissions & resource scopes <a href="#permissions-and-resource-scopes" id="permissions-and-resource-scopes"></a>

IDP 2.0 resources can be created at any scope, **Account**, **Organization**, or **Project**, and access is determined by the RBAC permissions configured at each level. You can use **predefined roles** or create **custom roles**, and organize permissions using **resource groups**. These follow the same model as the broader Harness RBAC framework.

| **Resource**   | **Permissions**                    | **Account Scope** | **Org Scope** | **Project Scope** | **Notes**                                                                                                                              |
| -------------- | ---------------------------------- | ----------------- | ------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Catalog**    | View, Create/Edit, Delete          | ✅                 | ✅             | ✅                 | Core entities like **Component**, **API**, **Resource** can be managed at all scopes.                                                  |
| **Workflows**  | View, Create/Edit, Delete, Execute | ✅                 | ✅             | ✅                 | Workflows can be created and executed at all scopes.                                                                                   |
| **Scorecards** | View, Create/Edit, Delete          | ✅                 | ❌             | ❌                 | Currently supported only at Account scope.                                                                                             |
| **Layouts**    | View, Create/Edit                  | ✅                 | Partial       | Partial           | Workflow Groups are supported at the Project and Org scopes. Other Layout functions are currently only supported at the Account scope. |
| **Plugins**    | View, Create/Edit, Toggle, Delete  | ✅                 | ❌             | ❌                 | Only supported at the Account scope.                                                                                                   |
| **Teams**      | View, Create/Edit, Delete          | ✅                 | ✅             | ✅                 | A permission on a Team also applies to the catalog entities that Team owns.                                                            |

### Configure RBAC for account-level catalog entity creation <a href="#configure-rbac-for-account-level-catalog-entity-creation" id="configure-rbac-for-account-level-catalog-entity-creation"></a>

This example shows how to configure RBAC to allow full control over Catalog entity creation and modification at the **Account scope** (including all child resources).

In this example, we use:

* A custom role: **IDP Catalog Create**
* *(Optional)* A custom resource group: **All Catalog Create Resources**
* *(Optional)* A custom user group: **Catalog Create Users**

The **All Catalog Create Resources** group exists at the **Account scope** and provides **Create/Edit** access to all Catalog entities across the account, including all organizations and projects. The **IDP Catalog Create** role includes the **Create/Edit** permission for Catalog resources.

You can access **Administrative Settings** from your Harness UI directly using the sidenavbar.

{% embed url="<https://app.arcade.software/share/nfyUVWqL523N4CQVzhH6>" %}
Access Admin Settings
{% endembed %}

***

**Step 1: Create the IDP Catalog Create role**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.arcade.software/share/4bhZDrNe0s9YVnyw8xCf>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **Roles** under the **Access Control** section.
2. Click **New Role** to create a new role.
3. Name the role **IDP Catalog Create**. (Optional: Add a description and tags.)
4. Click **Save**.
5. Under **Permissions → Developer Portal**, select:
   * **Catalog** → **Create/Edit**
6. Click **Apply Changes**.
   {% endtab %}
   {% endtabs %}

> Learn more about roles: [Manage roles](/harness-ai/use-harness-platform/platform-access-control/add-manage-roles.md) | [Permissions reference](/harness-ai/use-harness-platform/platform-access-control/permissions-reference.md)

***

***(Optional)*****&#x20;Step 2: Create a custom resource group**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.arcade.software/share/0ZWpaH50uzvdjTPxSMWj>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **Resource Groups** under **Access Control**.
2. Click **New Resource Group**.
3. Name the group **All Catalog Create Resources**. (Optional: Select a color, description, and tags.)
4. Click **Save**.
5. For **Resource Scope**, choose **All (including all Organizations and Projects)**. This grants access to the selected resources across the account, including all orgs and projects. [More on Resource Scopes](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md#scopes-and-refinement)
6. For **Resources**, select **Specified**, and then add **Catalog** from the table.
7. Click **Save**.
   {% endtab %}
   {% endtabs %}

> Learn more: [Manage resource groups](/harness-ai/use-harness-platform/platform-access-control/manage-resource-groups.md)

***

***(Optional)*****&#x20;Step 3: Create the "Catalog Create Users" user group**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.arcade.software/share/pcRUxzudsxcvcF04AaHc>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **User Groups** under **Access Control**.
2. Click **New User Group**.
3. Name the group **Catalog Create Users**. (Optional: Add a description and tags.)
4. Under **Add Users**, select the users to include in this group.
5. Click **Save**.
   {% endtab %}
   {% endtabs %}

> Learn more: [Manage user groups](/harness-ai/use-harness-platform/platform-access-control/add-user-groups.md) | [Manage users](/harness-ai/use-harness-platform/platform-access-control/add-users.md)

***

**Step 4: Assign the role and resource group to the user group**

{% tabs %}
{% tab title="Interactive guide" %}
{% embed url="<https://app.arcade.software/share/le6foVtudTknKtqKl4Ha>" %}
Create the IDP Catalog Create Role
{% endembed %}
{% endtab %}

{% tab title="Step-by-step" %}

1. In Harness, go to **Account Settings** → **User Groups**.
2. Find the **Catalog Create Users** group and click **Manage Roles**.
3. Under **Role Bindings**, click **Add**.
4. For **Role**, select **IDP Catalog Create**.
5. For **Resource Group**, select **All Catalog Create Resources**.
6. Click **Apply**.
   {% endtab %}
   {% endtabs %}

> Learn more: [Role binding](/harness-ai/use-harness-platform/platform-access-control.md#role-binding)

This setup configures RBAC so that users in the **Catalog Create Users** group have **Create/Edit** access to Catalog entities at the **Account scope**, as well as within all Organizations and Projects under the account.

{% @harness-feedback/feedback %}