All 29 RBAC questions
More in RBAC
What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy? How do you grant fine-grained permissions like sync but not delete? How do you manage RBAC for API/automation accounts (project roles and tokens)? How does the scopes setting affect group mapping? How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely? How do you separate duties between who can create apps and who can sync them? How do you enforce that only signed/approved commits get deployed?
Advertisement
ArgoCD › RBAC

How do you troubleshoot 'permission denied' errors in ArgoCD?

Advanced

Answer

Check the user's group claims (via the token/SSO), confirm matching `g` bindings and `p` rules in policy.csv, verify the object scope (project/app) matches, and remember deny-by-default. The scopes setting must reference the correct claim (e.g., groups). Enabling debug logging on the API server shows which policy decision was made.
Real-world example A user denied sync is fixed by correcting the scopes setting so their SSO group claim is read and mapped to a role.

Common follow-ups: What does the scopes setting control? | Why check the object scope?

RBAC Multi-cluster Applications
All 29 RBAC questions