Skip to main content
Coming Soon - This feature is currently in development and not yet available.

​
What It Does

Capability-Based Access Control (CBAC) brings fine-grained, resource-level permissions to Monk. Instead of simple role-based access (owner/admin/member), you’ll be able to grant specific capabilities on individual resources to team members and autonomous agents. Example: Grant “deploy to staging-cluster only” permission, or “read production logs but cannot modify anything.”

​
Why It Matters

​
Precision Over Broad Roles

Today’s role-based access is coarse-grained:
  • Admin can do too much (security risk)
  • Member can do too little (creates friction)
  • No way to grant “staging only” access
  • Can’t restrict autonomous agents to specific operations
CBAC solves this with resource-level permissions:
  • Grant exactly what’s needed, nothing more
  • Different permissions for staging vs production
  • Fine-grained control for AI agents
  • True principle of least privilege

​
Use Cases

For team members: Give frontend developers deploy access to frontend services only, database admins access to database operations only, junior developers access to dev environment only. For autonomous agents: Limit Watcher to monitoring and restarts, limit CI/CD agents to deployments only, prevent cost optimization agents from deleting resources. For contractors: Grant time-limited access that expires automatically after project ends.

​
Key Benefits

Security:
  • Minimize blast radius of compromised accounts
  • AI agents operate with minimal required permissions
  • Audit trail of all capability grants and usage
Flexibility:
  • Per-resource, per-environment, per-cluster permissions
  • Temporary access grants
  • Conditional capabilities requiring approval
Safety:
  • Autonomous agents can’t exceed granted capabilities
  • Two-person rules for critical operations
  • Instantly revocable permissions

​
Migration from Roles

When CBAC launches, existing role-based access remains:
  • Current roles automatically map to capability sets
  • No disruption to teams
  • Optionally refine to resource-level permissions
  • Keep simple roles or go fine-grained - your choice