Identity and access
Use separate access controls for the Kubernetes deployment, the identity provider, and Graph Studio. Do not use a shared administrator identity across those responsibilities.
Separate the access planes
| Access plane | Control it governs | Recommended owner |
|---|---|---|
| Kubernetes platform | Cluster, namespace, operator, workload, and Secret access | Platform administrator |
| Identity provider | User identities, groups, realm, client, and authentication policy | Identity administrator |
| Graph Studio | Authenticated user and product-administration access | Graph Studio administrator |
Grant each administrator only the permissions required for their plane. A person may hold more than one role only where the organization has approved that separation-of-duties exception.
Kubernetes access
Apply least privilege to human users, ServiceAccounts, and automation identities.
- Give routine Graph Studio administrators namespace-scoped access rather than cluster-wide administrative access.
- Use a platform administrator for cluster-scoped installation actions, such as CRD and ClusterRole creation.
- Set the operator watch namespace to the intended namespace where the supported deployment setting allows it. An empty watch namespace can expand the operator's scope.
- Grant the operator and workload ServiceAccounts only the permissions required by the release-provided deployment artifacts.
- Do not grant
privilegedpod permissions or a broad SCC unless release documentation explicitly requires them.
The installation prerequisites provide the required permission checks. The configuration reference identifies the Graph Studio operator watchNamespace setting.
Protect sensitive Kubernetes resources
Limit read access to the resources that can disclose or modify sensitive Graph Studio settings:
Secretresources, including registry credentials, Graph Studio credentials, and TLS material.- Graph Studio
Anzocustom resources, which can contain bootstrap and licensing material. - Helm release Secrets and values files, which can contain credentials or other sensitive overrides.
Do not grant broad read/list access to these resources merely to support routine application use. Use named administrative identities and retain ownership of emergency access according to organizational policy.
User management
Use named identities for administrators and users. Maintain an approved lifecycle for account creation, access changes, and removal when a user changes role or leaves the organization.
Where Keycloak is used, make the identity team responsible for identity, group, and client lifecycle management. The Keycloak guidance covers the identity-provider boundary.
Product authorization boundary
This documentation does not define Graph Studio's product roles, default privileges, or Keycloak group/claim-to-role mapping. Confirm those behaviors for the selected Graph Studio release before documenting or enforcing product-specific authorization policy.