What can a service account do in the environments you grant it?
Give an app or build its own account and review which apps and environments it can access. Phase documents the default Service role with permission to read and change secrets in its granted scope. If the build should only read, check the roles and plan before assuming that the default fits.
When does a second build or app affect the plan?
Cloud Free lists up to five user or service accounts and three apps with development, staging and production environments. Paid plans list custom roles and recovery options. Phase also documents self-hosting. In that setup your team is responsible for operating the service.
What can you keep without sharing the actual settings?
Keep the app and environment structure, service account scope and a record of the systems that issue the private values. Phase documents import and export. Treat any file that contains a real value as private. Leave values out of ordinary handoff notes and shared tickets.
Would the default role give a build more access than it needs?
On paper, sketch a documentation build that should only read a fictional test setting. Write read and change in separate columns.
- Compare the plan with the roleMark only read as needed. Compare it with the default role’s read and change permissions.
- Record the unresolved gapIf the available role gives more access than the build needs, leave the access decision open until your team has an appropriate scope and role.