Conversation
Explains that a role-scope binding (sparse ACL) entitlement only exists while it has an active grant, and the practical implications: use entitlement configuration rules instead of a per-entitlement max duration, and don't assume entitlement ID stability across a delete/recreate cycle unless entitlement resurrection is confirmed enabled for the tenant. Draft based on reading ductone/c1 (pkg/controller/app/controller/entitlement.go, pkg/builtin_tenant/features_2025.go) — needs review from the platform team before merging. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new section to
product/admin/cloud-infrastructure-access.mdxexplaining that role-scope binding ("sparse ACL") entitlements only exist while they have an active grant, and what that means in practice for max durations and ID stability.Context
From this thread: a Garmin ticket surfaced that a newly-created Azure entitlement had no max duration set, because it's a sparse-ACL/role-scope-binding entitlement that gets deleted and recreated based on grant existence. Nestor asked where this is documented — it wasn't, so this PR adds it.
This is a best-guess draft based on reading
ductone/c1source, not confirmed with the platform team:pkg/mapper/entitlement/v2/uplift.go(an entitlement is marked deleted when the connector no longer reports a matching connector entitlement) plus this thread's confirmation that sparse-ACL connectors like Azure only report role-scope pairs with an active grant.pkg/controller/app/controller/entitlement.go'sfindOldEntitlement/createOrResurrectEntitlement, gated byFEATURE_FLAG_ID_RESURRECT_APP_ENTITLEMENTS(depends onRESURRECT_APP_RESOURCES→RESURRECT_APP_RESOURCE_TYPES). Inpkg/builtin_tenant/features_2025.go,RESURRECT_APP_ENTITLEMENTSisFEATURE_FLAG_STATUS_SKU_MANUALwithNewTenantDefault: true— i.e., on by default for new tenants, but must be manually enabled for tenants that predate that default. @GowthamiDommety, can you confirm this reading is correct, and whether it's safe to tell customers to "ask C1 Support" to check/enable it?@OneWhoNests — this is meant to answer the "where's this documented" question from the thread; let me know if it's missing the context you actually needed.
🤖 Generated with Claude Code