Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

credential scope

What one login is allowed to do -- as little as its holder needs.

Credential scope is the set of rights attached to one credential; scoping gives each device, service or token only the rights its holder needs, never shared.

Examples

  • Bench node gh-a1's credential is scoped to publish only gh1/gh-a1/telemetry/# and gh1/gh-a1/status and read only gh1/gh-a1/cmd/#.

  • The ingester's broker account can read telemetry and status but never write a cmd topic.

See also

blast radius least privilege access control list
Read the full section →