From 6d26d99877db96004b283985098c20c3795a7a0f Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Wed, 19 Aug 2026 12:41:31 -0600 Subject: [PATCH] docs(psirt): who can use PSIRT, and why the permission beats the role PSIRT admitted a superuser or a global Maintainer/Owner and nobody else, so the docs had nothing to say about access beyond the feature flag and the licence. With a PSIRT configuration permission now available, the page can say the thing that matters: prefer the permission, because a global Maintainer role is write access to every asset in the instance and granting it to hand somebody PSIRT hands them the rest of the product too. Covers the view/change split, that View is genuinely read-only, that the licence is checked before any of it and is not a permission, and that the permission only appears in the picker while the PSIRT flag is on. --- docs/content/psirt/_index.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docs/content/psirt/_index.md b/docs/content/psirt/_index.md index 701f6caad4..9aa3f6abe9 100644 --- a/docs/content/psirt/_index.md +++ b/docs/content/psirt/_index.md @@ -37,6 +37,36 @@ If the entries are visible but locked, that is the other gate: the licence. PSIRT needs the **PSIRT Advisory Engine** entitlement, and a locked entry explains what to ask for. +## Who can use PSIRT + +Three things admit a user, and only one of them needs to be true: + +- the **PSIRT** configuration permission, +- a global **Maintainer** or **Owner** role, or +- superuser. + +**Prefer the configuration permission.** A global Maintainer role is write access +to every asset in the instance, so granting it to give somebody PSIRT hands them +the rest of the product as well. The PSIRT permission grants PSIRT and nothing +else. + +It comes in two halves, assignable separately from **Settings → User Management** +on a user or — more usefully — on a group: + +| Permission | Admits | +|---|---| +| **View PSIRT** | Reading every PSIRT surface: the advisory queue, exposure verdicts, cases, components, rules. | +| **Change PSIRT** | Everything View admits, plus writing: suppressing advisories, authoring feed and matching rules, opening cases, publishing advisories. | + +View is genuinely read-only. An analyst who should see whether you are affected, +without being able to suppress an advisory or publish one, gets View alone. + +The licence is checked *before* any of this and is not a permission: with no +**PSIRT Advisory Engine** entitlement, PSIRT is closed to everyone including +superusers. + +The permission appears in the picker only when the PSIRT feature flag is on. + ## How it fits together 1. **[Advisory Feeds](feeds/)** — choose which publishers to poll. Every source