Kubernetes / Access control
See who can do what.
Know exactly why.
Turn Roles and bindings into an understandable access map. Test an identity, surface risky grants, and compare changes before they reach a cluster.
01 / Provide policy
YAML or JSON
RBAC manifests
Tip: export only RBAC objects. Kubeconfig and Secret input is blocked.
Waiting for RBAC manifests.
02 / Review access
Not analyzed
Access posture
Make RBAC relationships visible
Add manifests on the left or load the sample to build an effective permission map and security review.
Effective grant paths
0
Access composition
Prioritized by reach and capability
Highest-access identities
What to inspect first
Priority review
Analysis coverage
All binding references resolved
0 RBAC objects analyzed
0 subjects
0 roles
0 bindings
03 / Investigate
Effective access review
Subject-to-permission paths
Each row explains how an identity receives a group of permissions.
Test an effective permission
Check the supplied manifests and see every binding that contributes.
Ready for a question
Describe an identity, action, and target to test effective RBAC access.
Least-privilege starting point
Generate a scoped grant
This draft grants only the queried action. Review it against your workload and admission policies before applying.
Effective permission matrix
Search subjects, namespaces, bindings, roles, resources, or verbs.
| Subject | Scope | Granted through | Resources | Verbs |
|---|
Review signals
Deterministic checks for permissions that deserve human review.
Signals are guidance, not a substitute for admission control, policy
enforcement, or a live Kubernetes authorization check.
Compare effective access
The current analysis is the baseline. Add a proposed RBAC snapshot below.
No comparison yet
New and removed subject permissions will appear here.
04 / Use responsibly
Understand the model and its limits.
Kubernetes RBAC permissions are additive: Roles define permissions, while bindings grant those permissions to identities at namespace or cluster scope.
Bindings decide where access applies
A RoleBinding grants access only in its namespace—even when it references a ClusterRole. A ClusterRoleBinding grants cluster-wide access.
Analyze a complete export
Referenced roles must be included. External authorization webhooks, admission policies, and identity-provider group membership are not inferred.
Confirm against the live cluster
Use kubectl auth can-i for an authoritative live-cluster
check after reviewing this static model.