Zum Hauptinhalt springen

Detailed text description: Role inheritance

This page describes the role inheritance diagram used in the Access Management article.

Structure​

The diagram has three columns, one per level, from left to right:

  1. Organization.
  2. Resource Group.
  3. Workspace.

Each column lists its roles from most privileged at the top to least privileged at the bottom. The rows line up across columns, so roles in the same row sit at the same privilege tier.

Roles in each column​

  1. Organization: Owner at the top, Member at the bottom.
  2. Resource Group: Admin at the top, Member at the bottom.
  3. Workspace: Admin at the top, Editor in the middle, Viewer at the bottom.

Arrows within a column​

A solid arrow points down from each role to the next role below it in the same column. It means the higher role includes every permission of the lower one:

  1. Organization Owner includes Organization Member.
  2. Resource Group Admin includes Resource Group Member.
  3. Workspace Admin includes Workspace Editor, and Workspace Editor includes Workspace Viewer.

Arrows between columns​

Highlighted arrows point from a role on one level to the role it grants on the level inside it:

  1. Organization Owner points to Resource Group Admin, labelled "in every Resource Group". An Owner is Admin of every Resource Group in the Organization.
  2. Resource Group Admin points to Workspace Admin, labelled "in every Workspace". A Resource Group Admin is Admin of every Workspace in the Resource Group.
  3. Resource Group Member points to Workspace Viewer, labelled "in every Workspace". A Resource Group Member is Viewer of every Workspace in the Resource Group.

A dotted arrow points from Organization Member to Resource Group Member, labelled "can join as Member". It does not grant a role. It shows that only Organization Members can be added to a Resource Group.

Reading the diagram as a whole​

Following the highlighted arrows from the top left, an Organization Owner is Admin of every Resource Group and therefore Admin of every Workspace. Following them along the bottom row, a Resource Group Member is Viewer of every Workspace in that Resource Group.