Access policies

An access policy groups members, users by email or service users by name, with the grants they all share: a role on an environment, service, blueprint, or the org itself. Giving five engineers operator on three environments used to mean fifteen grants to keep in sync, and now one policy carries them all. Use * in place of a resource name to extend a grant to every resource of that type, so viewer:blueprint:* covers blueprints nobody has created yet.

AccessPolicy is a first-class resource. Commit it to your IaC repo alongside your services and environments, manage it from Settings, or iterate on it locally with ryvn create -f / ryvn replace -f.