From 5003b0d217d6c6c8b46169ad9ad1677b3d8e477f Mon Sep 17 00:00:00 2001 From: devGregA Date: Fri, 21 Aug 2026 22:24:59 -0600 Subject: [PATCH] docs(organizations): the type-scoped grants UI (Roles page card + organization indicator) Co-Authored-By: Claude Fable 5 --- .../engagements_tests/PRO__organizations.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/docs/content/asset_modelling/engagements_tests/PRO__organizations.md b/docs/content/asset_modelling/engagements_tests/PRO__organizations.md index 9417e2bdf8d..04e08df7e6c 100644 --- a/docs/content/asset_modelling/engagements_tests/PRO__organizations.md +++ b/docs/content/asset_modelling/engagements_tests/PRO__organizations.md @@ -196,11 +196,24 @@ is worth knowing before re-typing a live Organization. Because a type-scoped grant reaches Organizations that do not exist yet, it cannot be delegated through permissions on any single Organization. **Only superusers and global -owners can view or manage these grants**, on the API at +owners can view or manage these grants**, in the UI or on the API at `/api/v2/organization_type_roles/` (filterable by `org_type`, `user`, `group`, and `role`). A grant names either a user or a group — a group grant applies to the group's members — and each grantee holds at most one role per type. +In the UI, grants live on the Roles settings page (**Settings → Roles**), in an +**Organization Type Roles** card that appears for global owners once the feature is +enabled. The card lists every grant with its type, grantee, and role; **New Grant** +opens a dialog that takes the Organization type, a user or group, and the role, and +each row offers a revoke action with a confirmation step. + +On an Organization's own view, a **type-scoped grant** indicator appears beside the +title when one or more grants cover that Organization's type. Hovering it lists the +grants (role and grantee), and clicking it opens the Roles page. The indicator is +visible only to superusers and global owners, the same audience that can read the +grant list itself, so an Organization-level viewer learns nothing about who holds +broad access. + Grants are created and revoked rather than edited: to change the role or the type, revoke the grant and create the replacement, which keeps the audit trail honest about what access existed when. Grants remain readable and revocable even if the feature is