FOR PLATFORM TEAMS
Give people access without giving them the keys.
A small platform or infrastructure team supporting developers who need to ship.
The bottleneck is rarely capability. It is that the safe way to let someone restart a service is to sit with them, and the fast way is to hand over credentials you cannot take back.
WHERE YOU ARE NOW
The access problem, currently.
A developer needs to restart a worker in staging. The options are: do it for them, or give them SSH to the host. There is nothing in between.
Someone gets a kubeconfig with cluster-admin because writing a narrower role is half a day of yaml, and it was urgent.
An engineer leaves. Revoking their access means finding every key, every kubeconfig and every cloud credential they were ever given a copy of.
Something was changed during the incident. Establishing who, and what it was before, takes longer than fixing it did.
WHAT CHANGES
What actually changes.
Permissions instead of credentials
People get the ability to perform an action on a named resource. They never hold the key that performs it, so there is nothing to copy and nothing to leave behind.
how it works →Narrow scopes without yaml
“Restart containers on these three servers” is a permission, not a bespoke role definition. Granting it takes a minute rather than an afternoon.
how it works →Gates on the things that deserve them
Most actions run immediately. The irreversible ones pause for a second person, with the computed diff in front of them.
how it works →Offboarding is one action
Disable the account. Every key they used stays exactly where it is, because they never had a copy of it.
how it works →THE OUTCOME
What you get back.
Fewer interruptions, and a smaller blast radius when something does go wrong. The team stops being the human access-control layer between developers and their own services, which is the part of the job that scales worst and satisfies nobody.
Granularity is only useful if you actually use it. The default roles are broad on purpose; narrowing them is your call, not a setup step.
OTHER WAYS PEOPLE RUN IT
Model one team’s access.
Start with read-only for everyone and add the specific things people keep asking you for.