How permission inheritance works

Automation orchestrator combines permissions from all your direct and group role assignments into a single effective permission set.

You accumulate permissions from multiple sources:

• Direct role assignments (system or project scope)
• Group role assignments from all groups you belong to
• Automation orchestrator evaluates all sources as a union (not intersection)
• If any source grants a permission, you have that permission
• Access is denied when no allow policy matches (deny-by-default)

Example:

• User Alice has a direct auditor role assignment at system scope.
• Alice belongs to group network-admins which has admin role at system scope.
• Alice belongs to group workflow-developers which has project-user role scoped to project "Dev".
• All authenticated users, including Alice, are in the authenticated group with the authenticated role.
• At system scope: Alice inherits admin permissions (most permissive from all sources).
• In project "Dev": Alice also has project-user permissions from the project-scoped assignment.