Properties
name
string — required
Unique identifier for the policy within the org. Lowercase alphanumeric with hyphens, up to 63 characters. Used in logs, events, and dashboard listings.
description
string — optional
Human-readable description of the policy’s purpose. Up to 256 characters. Helpful for teammates auditing who has what access.
members
array — required, minimum 1 entry
Who the policy applies to. Each entry is a kind:identifier string.
Members must already exist in the org. An unresolved user or service user fails the sync.
grants
array — required, minimum 1 entry
What access members receive. Each entry is a role:resourceType[:name] string.
role— one ofadmin,billing_admin,developer,operator,viewer.resourceType— one oforg,environment,service,blueprint.name— the resource name, or*for a type-scoped wildcard. Omit the segment fororggrants.
*) grants match any resource of the given type, including resources created later.
Roles
Not every role is meaningful on every resource type — for example,
billing_admin only applies at the org level. The sync rejects unsupported combinations.
Roles also decide who may request and approve temporary cluster access: developer and operator on an environment can both request access and decide someone else’s request, viewer can only read the record, and only admin can author the permission sets those requests name. See Just-in-time kubectl access for the full request-and-approve workflow.
Last-admin protection
Ryvn prevents the org from losing its lastadmin:org binding. Updates that would drop to zero org admins (across all policies) are rejected with a LastAdminProtection error. You can always remove admins as long as at least one admin remains somewhere in the org.