Skip to content

Enhancing custom permissions#2152

Open
trujillo-adam wants to merge 4 commits intomainfrom
IPE-1348-Enhancing-Custom-Permissions-For-Terraform
Open

Enhancing custom permissions#2152
trujillo-adam wants to merge 4 commits intomainfrom
IPE-1348-Enhancing-Custom-Permissions-For-Terraform

Conversation

@trujillo-adam
Copy link
Copy Markdown
Contributor

This PR adds documentation for the new set of permissions that allow organization admins to disable soft mandatory policy failure overrides, delegate authority to project and workspace managers, or allow all soft mandatory policy failure overrides.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

Vercel Previews Deployed

Name Status Preview Updated (UTC)
Dev Portal ✅ Ready (Inspect) Visit Preview Fri Apr 3 23:23:03 UTC 2026
Unified Docs API ✅ Ready (Inspect) Visit Preview Fri Apr 3 23:19:01 UTC 2026

@trujillo-adam trujillo-adam marked this pull request as ready for review April 3, 2026 19:49
@trujillo-adam trujillo-adam requested a review from a team as a code owner April 3, 2026 19:49
@trujillo-adam trujillo-adam changed the title Ipe 1348 enhancing custom permissions for terraform Enhancing custom permissions Apr 3, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 3, 2026

Broken Link Checker

This PR contains broken links, but won't be blocked. Use this report to improve content quality:

Quick Actions

  • Internal links (HashiCorp sites): Please fix these - they impact user experience
  • External links: Consider if these are essential or can be updated/removed
  • Temporary issues: External sites may recover - check again before merging

Need Help?


Internal Links

Full Github Actions output

External Links

Full Github Actions output

Copy link
Copy Markdown
Contributor

@mattschouten mattschouten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple small changes and thoughts. Approving so you can merge when ready.

### Delegate policy overrides

Allow project and workspace managers to grant override permissions for **Soft mandatory** policy evaluations. When this setting is enabled, overriding failed policy evaluations is disabled by default. Project and workspace managers must manually enable the **Allow policy overrides** setting in their projects and workspaces.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These sections don't add much information beyond what's in the table already. What do you think about moving the "Refer to the projects and workspaces..." bit to the table, and removing these sections?

(I'm ok if not)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just following the template we set up. The separate headings also give us direct links to each setting.

| --- | --- |
| [No policy overrides](#no-policy-overrides) | Teams can’t override failed **Soft mandatory** policy evaluations. |
| [Delegate policy overrides](#delegate-policy-overrides) | Allow project and workspace managers to grant override permissions for **Soft mandatory** policy evaluations. When this setting is enabled, the ability to override failed policy evaluations is disabled by default. Project and workspace managers must manually enable the **Allow policy overrides** setting in their projects and workspaces. |
| [Manage policy overrides](#manage-policy-overrides) | Team members can override failed **Soft mandatory** policy evaluations in all workspaces. |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it also worth making it explicit that Manage policy overrides gives read access to all workspaces in the organization, while Delegate policy overrides does not? The read all workspaces behavior of the existing setting has been a big pain point for customers, so I'm wondering if we can highlight how Delegate is better.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added this to the more detailed description linked from this table.

@santur198922-sketch
Copy link
Copy Markdown

santur198922-sketch commented Apr 3, 2026 via email

Co-authored-by: Matt Schouten <matt.schouten@gmail.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants