Environment Access and Granular RBAC
Architecture Overview
Once your operational identity is established, CloudAIPilot enforces a cloud-grade, highly secure Role-Based Access Control (RBAC) architecture. This system is designed for enterprise compliance and is strictly enforced across both human interfaces (the dashboard) and the AI Pilot control plane.
Unlike legacy systems that use flat roles, CloudAIPilot allows you to secure your infrastructure with precision, utilizing resource-scoped boundaries, IP restrictions, and time-based access constraints.
Advanced Access Control Features
When provisioning access to your team members, agencies, or contractors, the RBAC engine evaluates requests against several parameters:
1. Granular Permissions and Custom Roles
You are not restricted to generic administrative roles. You can create custom roles from a matrix of over 46 individual permissions. For example, you can grant a developer the ability to deploy applications (app:deploy) without allowing them to provision or delete the underlying servers (server:delete). Once configured, you can save this custom role as a reusable template to instantly apply the exact same security boundaries to future team members.
2. Pre-Configured Role Templates
For rapid onboarding, CloudAIPilot provides 5 enterprise-grade role templates:
- Deployment Manager: Authorized to deploy and manage sites and apps, but restricted from altering core server infrastructure.
- Monitoring Observer: Read-only access across the platform, with authorization to manage alerts (ideal for on-call engineers).
- Client Viewer: Strictly read-only, heavily resource-scoped (ideal for agency clients).
- Billing Manager: Access to FinOps and billing configurations, completely isolated from infrastructure access.
- Security Auditor: Comprehensive read access and audit log visibility for compliance officers.
3. Resource-Scoped Access
Access can be scoped to specific resources. Instead of granting a contractor access to all servers, you can limit their permissions to a single staging server or a specific cloud account.
4. Zero-Trust Access Policies (IP & Expiry)
For maximum operational security, roles can be bound to specific network conditions:
- IP Restrictions: Deny access unless the request originates from your corporate VPN or a specific allowed IP block.
- Time-Based Expiry: Provision temporary access that automatically revokes itself. Perfect for temporary contractors or emergency incident response (break-glass scenarios).
AI Pilot Awareness
The CloudAIPilot access matrix is universally enforced. The AI Pilot engine is deeply integrated with the RBAC ruleset. If a team member does not have permission to delete a server manually, the AI Pilot will categorically refuse to execute that action on their behalf. This ensures that the AI cannot be used as a vector to bypass your organization's security boundaries.