All 29 RBAC questions
More in RBAC
How do you restrict which repositories a project can use? How do you prevent a team from deploying to namespaces they don't own? What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy? How do you manage RBAC for API/automation accounts (project roles and tokens)? How do you troubleshoot 'permission denied' errors in ArgoCD? How does the scopes setting affect group mapping? How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely?
Advertisement
Back to results for “RBAC”
ArgoCD › RBAC

How do you grant fine-grained permissions like sync but not delete?

Advanced

Answer

List only the allowed actions in policy lines, omitting others (default deny). For example allow get and sync but not delete or override. Because ArgoCD RBAC is deny-by-default, granting sync without a delete rule means the user can trigger syncs but cannot delete the application.
p, role:operator, applications, get, '*/*', allow
p, role:operator, applications, sync, '*/*', allow
# no delete rule -> delete denied
Real-world example On-call operators can sync any app to recover from drift but cannot delete apps, limiting accidental damage.

Common follow-ups: Is ArgoCD RBAC deny-by-default? | How do you allow sync but block delete?

Applications Sync & Health RBAC
All 29 RBAC questions