I’ve run into the following problem with multiple enterprise projects where we’ve struggled with security around credentials and how they can be used within teams. The problem is that any editor can access any credential for the team in which they are on. Currently there is no clean fix to this other than creating a separate team where that credential can live however this does not scale. We cannot create a team for every story that requires a unique permission schema. My proposal (and I am open to better solutions) is to allow an admin to:
- Assign allowed stories to specific credentials
- Assign allowed users to specific stories
This would mean that an admin can decide that a credential wont activate or pull a token in stories in which it is allowed (meaning builders cant randomly use it in stories which are not approved) and secondly we can go even further to decide who is able to even access the stories in which it is enabled on.
For example we’ve had automations that require api’s with scope at the highest level. I want that credential be available for ONLY that story and I want admins to be the only ones who can access that story. By having those two rules I have effectively chosen who can use that high level credential and how they can use it as well.
Curious on thoughts here or if there is a solution I’ve missed. Thanks!