Skip to main content
Access control on the Control Plane Platform is handled in two separate ways: one for billing accounts, and the other for orgs.
Billing accounts have three roles that can be assigned when inviting users:
RoleDescription
billing_adminFull administrative access to billing settings and invoices
billing_viewerRead-only access to billing information
org_creatorAbility to create new organizations under the billing account

Principals

A “principal” is an entity that can be granted permissions. The Control Plane Platform supports four principal types, each scoped to an org.

Policy

A policy governs resource access within an org by binding principals to permissions on target resources.
A resource is a Control Plane object (e.g., secret, workload, GVC, etc.).A policy can target:
  • All resources of a specific type within your org
  • Specific resources assigned directly by resource self link
  • Dynamic resources matched using tag queries
For example, a policy can target all GVCs in your org, or specifically only “production-gvc” and “staging-gvc”.
A binding maps permissions to principals:Multiple bindings can exist on a single policy, allowing different permission sets for different principals.

Common Use Cases

Create a group for your team and add users as members. Create a policy that grants the group permissions on target resources (e.g., view and edit on specific GVCs). All group members automatically receive these permissions. When team members change, simply update group membership - no policy changes needed.
Create a service account and generate a key for authentication. Add the service account to a group with appropriate permissions, or create a policy granting it create and edit permissions on workloads. Create a CLI profile using cpln profile create PROFILE_NAME --org ORG_NAME --token KEY --default. The --default flag makes this profile active for all future commands without needing to specify --profile each time.
Create an identity and link it to your workload. Create a policy that grants the identity reveal permission on the target secret. Reference the secret in your workload as an environment variable (cpln://secret/SECRET_NAME) or volume mount. The workload can now access the secret value at runtime.
Create a service account for Terraform or Pulumi. Generate a key and configure your provider to authenticate with it. Create policies granting the service account permissions to manage the resources your IaC templates define (GVCs, workloads, secrets, identities, etc.).

Next Steps