Skip to main content
The Permission Audit page shows the current state of role assignments across your platform. Use it to answer two kinds of questions:
  • Who has access to a given System, Workspace, or Deployment, and through which role?
  • What can a specific user, Team, or service account do, and where does that access come from?
To open it, go to Roles and Permissions and click Permission Audit. The page has two modes: By entity and By principal.
Astro Private Cloud 2.1This feature was introduced in Astro Private Cloud 2.1. To access this feature, upgrade your Astro Private Cloud installation to 2.1 or later.
Permission Audit shows the current state of role assignments. It doesn’t show a history of past changes, such as who created or edited a role.

​
Prerequisites

  • System Admin access to Astro Private Cloud.
  • Custom roles enabled in your values.yaml file. See Enable custom roles.

​
Audit by entity

Use By entity to see everyone with access to a specific System, Workspace, or Deployment.
1

Select a scope

Select System, Workspace, or Deployment.
2

Select an entity

If you selected Workspace or Deployment, select the specific entity.
Principals with access appear grouped under Users, Teams, and Service accounts. Each row shows the role a principal holds and its source:
  • Direct: The role is assigned directly at this entity.
  • Workspace role: For a Deployment, the role comes from a Workspace-scoped assignment on the Deployment’s parent Workspace.
  • System role: The role comes from a System-scoped assignment, which applies everywhere.
Click a row to expand its effective permissions.

​
Audit by principal

Use By principal to see everything a specific user, Team, or service account can do.
1

Select a principal type

Select Users, Teams, or Service accounts.
2

Select a principal

Search for the principal, then select it.
Every entity the principal holds a direct role assignment on appears as a row, with its scope and role. Click a row to expand its effective permissions.
By principal lists a principal’s direct role assignments only. If a user holds a role only through Team membership, that assignment doesn’t appear as its own row; it surfaces in the effective permissions panel instead. See Effective permissions.

​
Effective permissions

Expanding a row shows:
  • Granted by: The roles contributing permissions at this scope and entity. A role held through Team membership is labeled via team <team-name>.
  • Effective permissions: The full set of permissions the principal has at this scope and entity, combining every contributing role.
By default, only granted permissions appear. Turn off Granted only to also show the permissions the principal doesn’t have at this scope, displayed struck through. Use this view to check for gaps before assigning a role, or to confirm a permission change had the effect you expected.

​
Export to CSV

Click Export CSV to download the current view as a comma-separated values (CSV) file. In By entity mode, the export includes one row per principal with access to the selected entity. In By principal mode, it includes one row per entity the selected principal has access to. Each row includes the principal, its type, scope, entity, roles, and effective permissions.

​
What’s next