---
id: w6/m6/t001
title: RBAC least-privilege audit
worker: worker6
status: done
estimate: 30m
depends_on: []
---

## Objective

Audit every ClusterRole/Role bound to the operator, bex-api, and platform components, confirming no wildcard verbs/resources and no unused grants.

## Context

- `lego/operator/config/rbac/role.yaml` and siblings (`role_binding.yaml`, `service_account.yaml`, `metrics_auth_role.yaml`, `leader_election_role.yaml`, `service_editor_role.yaml`, `service_admin_role.yaml`, `service_viewer_role.yaml`) — grepped clean of `"*"` wildcards, but not fully reviewed.
- Platform ServiceAccounts for Kratos, Hydra, OpenFGA, CNPG, OpenBao under `deploy/gitops/` — not yet audited.
- bex-api's own ServiceAccount/RBAC (if any distinct from the operator's).

## Steps

1. Enumerate every ClusterRole/Role + binding across `lego/operator/config/rbac/` and `deploy/gitops/`.
2. For each, list the ServiceAccount(s) it binds and whether every granted verb/resource is actually used by that component.
3. Flag any wildcard, cluster-wide, or unused grant.
4. Tighten scopes where safe; note any that can't be tightened without breaking functionality (with why).

## Files

- `lego/operator/config/rbac/*.yaml`
- `deploy/gitops/**/*.yaml` (platform component manifests)

## Acceptance criteria

- [ ] Every RBAC binding in the repo is enumerated with its actual-use justification.
- [ ] No wildcard verb/resource grants remain unless justified in writing.
- [ ] Findings recorded for t007's writeup.

## Out of scope

- Runtime RBAC enforcement testing (that's t004's live-verification scope for network policy, not RBAC).
