sentry-enterprise-rbac

# Sentry Enterprise RBAC ## Overview Configure Sentry's Organization-Team-Project hierarchy, role assignments, SSO/SAML2 federation, SCIM automated provisioning, API token governance, and audit logging. Covers the full enterprise access control lifecycle from initial setup through ongoing compliance monitoring. ## Prerequisites - **Sentry Business or Enterprise plan** — team-level roles, SSO, SCIM, and audit logs require Business tier or higher - **Organization Owner or Manager role** — only these roles can configure auth, teams, and member roles - **Identity Provider access** — admin credentials for Okta, Azure AD, or Google Workspace if configuring SSO/SCIM - **Environment variables set:** ```bash export SENTRY_AUTH_TOKEN="sntrys_..." # Auth token with org:admin, member:admin, team:admin scopes export SENTRY_ORG="your-org-slug" # Organization slug from sentry.io/settings/ ``` ## Instructions ### Step 1 — Establish the Organization-Team-Project Hierarchy Sentry's access model flows top-down: **Organization > Teams > Projects**. Members inherit permissions from their org-level role, then gain project access through team membership. **Organization-level roles** define the ceiling of what a member can do: | Role | Capabilities | Typical Use | |------|-------------|-------------| | **Owner** | Full control: billing, auth, members, all settings. Irremovable. | Founding eng, CTO | | **Manager** | Manage all teams, projects, and members. No billing access. ...