Folder RBAC for Object Creation and Editing

Users with editor permissions on folders can now create objects in Kloudfuse. This feature enables granular control over who can create objects within specific folders based on their permission levels.

Overview

Folder level RBAC for Kloudfuse object creation and editing allows users with editor permissions on a folder to create objects within that folder, without requiring global administrator privileges. This enables:

  • Granular access control - Control who can create objects on a per-folder basis

  • Organizational structure - Maintain clear ownership and organization of objects

  • Security compliance - Ensure objects are created only in approved folders with proper permissions

How It Works

Permission Evaluation

Kloudfuse evaluates permissions from multiple sources when determining folder access. Permissions can be assigned through various mechanisms including role-based permissions, folder-specific permissions, and individual user permissions.

When a user attempts to create an object in a folder, the system evaluates all applicable permissions and grants access based on the highest permission level found across all sources.

See example below for clarification.

Kloudfuse Objects

Kloudfuse objects affected by folder level RBAC include:

  • SLOs

  • Scheduled Views

  • Saved Queries

  • Lookup Tables

  • Favorite Facets

  • Scheduled Searches

Permission Requirements

To create objects in a folder, users must have:

  1. Edit permissions (or higher) from any applicable permission source

  2. The folder must exist and be accessible to the user

Permission Level Object Creation Rights

View

Cannot create objects (read-only access)

Edit

Can create, modify, and delete objects in the folder

Admin

Can create objects and manage folder permissions

Access Control Behavior

Folder Permission Checks

When creating an object, the system performs the following checks:

  1. Evaluates all applicable permissions from various sources

  2. Grants access based on the highest permission level found

  3. Verifies the user has Edit or Admin permissions on the selected folder

  4. Validates that the folder exists and is accessible

If any check fails, the object creation will be denied with an appropriate error message.

Examples of Permission Sources

Permissions can come from multiple sources. Below are examples of common permission assignment methods:

Role-based folder permissions - Permissions assigned to roles that apply to all users with those roles:

Folder-level permissions showing role-based access control

Individual user permissions - Permissions assigned directly to specific users:

User-level permissions showing individual user access control

Team permissions - Permissions assigned to teams that apply to all users in those teams:

Team-level permissions showing team-based access control

Example

Let’s say user1 has the editor role for his account, and is trying to create an object inside FolderA. Lets take a look at FolderA’s permissions: - Role-based folder permission: FolderA has View permission for editors - Individual user permission: user1 has Edit permission

Kloudfuse evaluates all applicable permissions and uses the highest permission level found. In this case, user1 will have Edit permissions for that folder and can create objects in FolderA.

FolderA permissions showing editor permission
FolderA user1 showing editor user permission

Exceptions

Users with viewer role cannot edit SLO Alerts

Example: Viewer Role with Folder-Level Editor Permissions

A folder contains an SLO alert, with folder permissions granting Edit access to users with the Viewer role:

  1. User role: Viewer

  2. Folder permission: Edit

  3. Object: Alert inside that folder

  4. Result: The user still cannot edit the alert

Root-Level Objects

Creating objects without a folder assignment (at the root level) will only check if the user’s account role is Admin or Editor.

Troubleshooting

Cannot Create Object in Folder

If you cannot create an object in a folder, check:

  1. Do you have Admin or Edit permissions on the folder from any permission source?

  2. Does the folder exist and is it accessible?

Folder Not Selectable in Dropdown

If a folder is greyed out in the folder selection dropdown, you may only have View permissions across all applicable permission sources.