Fine-grained access management

Fine-Grained Access Management (FGA) in the Identity Console is a security framework that enables precise control over administrative actions and resource access. Instead of relying on static, role-based entitlements, FGA introduces dynamic, policy-driven permissions that adapt to user roles, resource attributes, and contextual factors.

Each admin persona (like Support Tier 1, Tier 2, Technical Operations, etc.) is mapped to a set of permissions. The Admin console UI renders only what you’re allowed to see or do.

Permissions are named to match the navigation path in the UI. For example:

• app.read lets you view the application tab.
• users.profile.read lets you view a user’s profile.
• app.access.roles.update lets you update roles in the access tile.

Sensitive Permissions: Actions like deactivating a user, deleting a user, assigning roles, or handling credentials require explicit, sensitive permissions (e.g., users.profile.deactivate). These are never granted by default and must be assigned deliberately.

Non-Sensitive Permissions: Routine updates (like changing an application name or description) are covered by broader permissions (e.g., application.update). These don’t let you touch sensitive attributes like credentials or security compliance—those need their own explicit permissions.