job-function-scoped-roles

Type: decision

Decision

Access is granted by job function, not by resource type — new resource types never require a new role.

Why

Without job-function scoping, every new allowed resource type forces team re-onboarding.

Violations

• Custom role with wildcard write permissions.

Links

• landing-zone-platform-members — Joining the platform creates the Entra ID group that scopes engineer access — roles target the group.
• landing-zone-lifecycle — Reader on the 'Subscription Bank' is what allows engineers to discover subscriptions available for reuse.
• platform-break-glass — The wildcard violation holds only because break-glass names the single sanctioned exception.

← Back to knowledge graph