job-function-scoped-roles

Type: decision

Decision

Roles are scoped to a job function. A role describes what a person does (e.g., app engineer), not what resources they touch.

Why

Resource-specific roles multiply with every newly whitelisted resource type, frequently requiring team members to apply for new roles.

Links

• landing-zone-application-profile — The Application Profile creates an Entra ID group dedicated to application engineers, providing only the minimum access that does not break Infrastructure-as-Code principles.
• config-lives-in-the-repo — The platform-wide engineers group name (APP_ENGINEERS_GROUP_NAME) is sourced from githubVariables.json
• landing-zone-lifecycle — Reader on the subscription bank is what allows engineers to discover subscriptions available for reuse.

← Back to all decisions