From 67ee817c2d7b5b8d120616bd8600ad7af764ee09 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Fri, 11 Sep 2026 16:42:15 -0700 Subject: [PATCH 1/2] docs: document entitlement lifecycle for role-scope bindings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Explains that a role-scope binding (sparse ACL) entitlement only exists while it has an active grant, and the practical implications: use entitlement configuration rules instead of a per-entitlement max duration, and don't assume entitlement ID stability across a delete/recreate cycle unless entitlement resurrection is confirmed enabled for the tenant. Draft based on reading ductone/c1 (pkg/controller/app/controller/entitlement.go, pkg/builtin_tenant/features_2025.go) — needs review from the platform team before merging. Co-Authored-By: Claude Sonnet 5 --- product/admin/cloud-infrastructure-access.mdx | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/product/admin/cloud-infrastructure-access.mdx b/product/admin/cloud-infrastructure-access.mdx index 7f5de12f..7c3a9391 100644 --- a/product/admin/cloud-infrastructure-access.mdx +++ b/product/admin/cloud-infrastructure-access.mdx @@ -50,4 +50,16 @@ The following governance capabilities all work on the hierarchical model: **Provisioning** — C1 grants and revokes access at the specific scope it was requested or assigned, not at a flat entitlement level. +## Entitlements come and go with grants + +A role-scope binding only exists as an entitlement while it has at least one active grant. Cloud infrastructure connectors like Azure only report role-scope combinations that currently have someone assigned, so C1 doesn't sync a role-scope pair that no one holds. When the last grant on a binding is removed, the entitlement disappears; when someone is granted that same role at that same scope again, C1 creates it again. + +This has two practical implications: + +Don't set a maximum grant duration directly on one of these entitlements — if it gets deleted and recreated while no one holds it, a duration set on the old row doesn't carry over. Use [entitlement configuration rules](/product/admin/entitlement-config-rules) instead: a rule that matches on role and scope applies its maximum duration to every matching entitlement, including ones created after you save the rule. + + +Whether a recreated entitlement gets its original ID back depends on a tenant setting called entitlement resurrection, which is on by default for new C1 tenants. If your tenant predates that default, or you're not sure, ask C1 Support to confirm it's enabled before referencing one of these entitlements by ID — for example, from an access profile or from Terraform. + + From e38e8754683e80a0b70764f4dfd47cdb60e01bf9 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Fri, 11 Sep 2026 16:45:35 -0700 Subject: [PATCH 2/2] docs: use numbered list for the two implications Co-Authored-By: Claude Sonnet 5 --- product/admin/cloud-infrastructure-access.mdx | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/product/admin/cloud-infrastructure-access.mdx b/product/admin/cloud-infrastructure-access.mdx index 7c3a9391..27150389 100644 --- a/product/admin/cloud-infrastructure-access.mdx +++ b/product/admin/cloud-infrastructure-access.mdx @@ -56,10 +56,12 @@ A role-scope binding only exists as an entitlement while it has at least one act This has two practical implications: -Don't set a maximum grant duration directly on one of these entitlements — if it gets deleted and recreated while no one holds it, a duration set on the old row doesn't carry over. Use [entitlement configuration rules](/product/admin/entitlement-config-rules) instead: a rule that matches on role and scope applies its maximum duration to every matching entitlement, including ones created after you save the rule. +1. **Don't set a maximum grant duration directly on one of these entitlements.** If it gets deleted and recreated while no one holds it, a duration set on the old row doesn't carry over. Use [entitlement configuration rules](/product/admin/entitlement-config-rules) instead: a rule that matches on role and scope applies its maximum duration to every matching entitlement, including ones created after you save the rule. - -Whether a recreated entitlement gets its original ID back depends on a tenant setting called entitlement resurrection, which is on by default for new C1 tenants. If your tenant predates that default, or you're not sure, ask C1 Support to confirm it's enabled before referencing one of these entitlements by ID — for example, from an access profile or from Terraform. - +2. **Be cautious referencing one of these entitlements by ID** — for example, from an access profile or from Terraform. + + + Whether a recreated entitlement gets its original ID back depends on a tenant setting called entitlement resurrection, which is on by default for new C1 tenants. If your tenant predates that default, or you're not sure, ask C1 Support to confirm it's enabled. +