palantir-enterprise-rbac

# Palantir Enterprise RBAC ## Overview Configure enterprise-grade access control in Foundry: project roles (Viewer/Editor/Owner), organization-level groups, service user accounts for integrations, and marking-based data classification. ## Prerequisites - Foundry enrollment with admin access - Understanding of Foundry project structure - Familiarity with `palantir-security-basics` ## Instructions ### Step 1: Project Role Hierarchy | Role | Permissions | Use Case | |------|------------|----------| | Viewer | Read datasets, view Ontology objects | Analysts, stakeholders | | Editor | Read/write datasets, run builds | Data engineers, developers | | Owner | Full control, manage members, configure | Project leads, admins | ### Step 2: Create Service Users for Integrations ```text Developer Console > Applications > New Application: 1. Name: "order-sync-service" (descriptive of function) 2. Type: Server application (client credentials flow) 3. Scopes: api:read-data, api:ontology-read (minimum needed) 4. Project access: Add as Editor on specific projects only Result: client_id + client_secret (store in secrets manager) ``` ### Step 3: Scope Matrix by Application ```python # Define per-application scopes APP_SCOPES = { "dashboard-reader": ["api:read-data", "api:ontology-read"], "data-sync-service": ["api:read-data", "api:write-data"], "admin-tool": ["api:read-data", "api:write-data", "api:ontology-read", "api:ontology-write"], } def create_client_for_app(app_name: st...