Separate UI access from API/CLI access per role

[kc9wwh]

• Unpacked: TODO: Product Designer checks this box when the request goes through "Unpacking the why": https://fleetdm.com/handbook/product-design#unpacking-the-why
• Gong snippet: https://us-65885.app.gong.io/call?id=8895259222456284825&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A894%2C%22to%22%3A998%7D%5D

Interpretation

How do you interpret the customer's words?

A penetration test flagged the maintainer role as overly permissive. The finding: a maintainer opens "My account," copies their API token, and runs fleetctl against hosts, including arbitrary scripts. The customer wants maintainers to keep uploading software in the UI while losing the ability to reach the API outside it. Their words: "If someone has the maintainer role and generates an API token, they can run an arbitrary script against hosts."

What's Fleet missing?

• No per-role or per-user control over API or CLI access. fleetctl calls the same REST endpoints as the UI with the same bearer token, so there is no CLI-specific endpoint to block.
• Downscoping to technician does not close the finding. Technician holds host_script_result write alongside admin and maintainer, and the same authorization check covers saved scripts and ad-hoc script contents. Technician loses software upload and keeps script execution.
• GitOps mode restricts UI editing only. The server does not enforce it, so a token bypasses it.

What does the customer's ideal workflow look like?

1. An admin turns on a setting that separates browser sessions from API credentials.
2. A user signing in through the IdP receives a session that works in the UI. The API rejects that session.
3. Users who need CLI or API access receive an explicitly issued credential, granted per user or per role.
4. A maintainer keeps software upload in the UI. Without an issued credential, that maintainer cannot run fleetctl against hosts.
5. Existing API-only users and GitOps CI automation keep working untouched.
6. Admins list and revoke issued credentials, and each issuance lands in the activity feed for audit.