45 of 187 pages
Who May Do What
Every action in this guide and who is allowed to take it: a lone studio owner, the studio’s roles, an organisation’s owner and administrators, an identity provider, a pipeline, and someone with no account at all.
If you work alone
You are the studio’s owner, and you hold — or can give yourself — every studio role below. You approve both sides of an item, grant your own exceptions, issue and share passports, mint the deploy token and place a legal hold, on your own. Where one person decided both sides of something, the Go dialog and the passport say so — it is shown, not refused.
In a studio
| Action | Who |
|---|---|
| Read a passport; download it | Any member |
| Approve the human side of an item | A member of the reviewer role the item names, or any member where it names any human in the loop |
| Map controls to checklist items; edit the checklists | Owner or reviewer |
| Waive one of the studio’s own items, or stand in for its agent | Owner or reviewer |
| Override the reviewer agents on a gate | Owner or reviewer, with a justification and an acknowledgement |
| Reopen a gate that has passed | Owner or reviewer |
| Read and export the studio audit | Owner or reviewer |
| Issue a signed passport on demand | Owner or admin |
| Share a signed passport by link; revoke a link | Owner |
| Mint, rotate or revoke a deploy token | Owner |
| Open the pull request that creates pipelines, and choose enforce or warn | Owner |
| See the notice that evidence was not recorded | Owner |
| Place or lift a legal hold | Owner |
| Move a work package onto a newer policy version | Owner, before the package is dispatched |
| Turn on separation of duties (Trust Settings) | Owner |
| Say which studio role answers for each organisation role | Owner |
On an item your organisation put there
Where a studio belongs to an organisation with a guardrail policy, the policy decides who may set one of its items aside — and that binds the studio’s owner too.
| Action | Who |
|---|---|
| Remove, reword or weaken an organisation item | Nobody in the studio |
| Take an exception to one — grant, waive, renew, stand in for its agent | Where the policy names approver roles: only someone who holds one, as the studio maps them. Being the owner is not enough. Where it names none: owner or reviewer |
| Override the reviewer agents on a gate that holds one | Owner or reviewer and a holder of an approver role, where the policy names any |
| Answer an agent’s question with Met | A holder of the organisation role the item names, or of an approver role where it names none. Where the organisation names neither: owner, reviewer or the item’s own named role, as for the studio’s own items |
| Record a sample review verdict | A member of the organisation role the policy names, mapped to a named studio role |
| Unlink the studio from the organisation | Nobody in the studio. The organisation releases it |
A role that nobody holds refuses; it never falls back to the owner. A studio’s owner decides who holds roles in their studio, so an owner can hold an approver role themselves — the organisation’s register says so when they use it.
In an organisation
| Action | Who |
|---|---|
| Write, edit and activate a guardrail policy | An administrator, after signing in again. Needs the Enterprise contract |
| Retire a policy; require a named role for one of its reviewer roles | The owner |
| Read the exceptions register and guardrail coverage | An administrator |
| Release a studio from the organisation | The owner, or an administrator — but an administrator never for a studio they own themselves |
| Place or lift a legal hold on a studio’s artefact | The owner or an administrator |
| Declare how long evidence is kept | The owner |
| Make someone an administrator, by any route | The owner only |
| Remove an administrator | The owner, or the administrator themselves |
| Configure single sign-on | The owner only |
| Issue, rotate or disable the SCIM token | The owner only |
| Choose who holds the organisation’s roles inside a studio | Nobody in the organisation. Each studio maps its own people; the organisation sees the mapping |
Administrators can release studios, which is why becoming one is the owner’s decision by every way in. The detail is in Organisation Security and Guardrail Policies.
Your identity provider
A pipeline, with a deploy token
It can read the signed passport of a release that carries one of its own repository’s commits, and report a deployment or a bill of materials for one. It can do nothing else: not read the studio, not read the repository, not act for another repository. A signed-in person cannot use those routes either.
Someone with no account
What no person can do
Edit or delete an evidence entry; rewrite an issued passport; post an agent’s assessment or verdict on its behalf; set a control’s status; or choose which completed package is sampled. Those are the server’s, and that is the point of them.