Skip to content

Clarify that permissions can be assigned to users directly #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nscuro merged 1 commit into from
Apr 25, 2026
Merged

Clarify that permissions can be assigned to users directly #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions docs/concepts/access-control.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
# About access control

Dependency-Track uses a role-based access control model built around **permissions**,
**teams**, and **users**. Teams hold permissions, and users inherit the
**teams**, and **users**. Permissions can be assigned to teams or directly to users.
A user's effective permissions are the union of their direct permissions and the
permissions of every team they belong to.

## Users
Expand Down Expand Up @@ -36,12 +37,16 @@ first login.

## Teams

A team is a named collection of users and API keys. Teams hold permissions directly;
individual users do not. This makes it straightforward to manage access for groups of
people (for example, *Security Engineers*, *Developers*, *CI/CD Pipelines*) or automated systems.
A team is a named collection of users and API keys. Teams hold permissions, which makes
it straightforward to manage access for groups of people (for example, *Security Engineers*,
*Developers*, *CI/CD Pipelines*) or automated systems.

A user can belong to more than one team and inherits the union of all permissions from
every team they are a member of.
every team they are a member of. Permissions can also be assigned directly to a user.
Those permissions add to whatever the user inherits from their teams.
Comment thread
nscuro marked this conversation as resolved.

Prefer team-based assignment as the default. Use direct user permissions sparingly, for
Comment thread
nscuro marked this conversation as resolved.
exceptions that don't justify a dedicated team.

API keys belong to a team and carry the same permissions as that team. They authenticate
automated access (CI/CD pipelines, integrations) without associating requests with a
Expand Down