- name: DeveloperManage
  policies:
  - bindingscope: cloud-cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: CloudCluster
      operations:
      - Describe
  - bindingscope: cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: Cluster
      operations:
      - View
      - AccessWithToken
    - resourcetype: OwnKafkaClusterApiKey
      operations:
      - Describe
      - Alter
      - Delete
      - Create
    - resourcetype: OwnClusterApiKey
      operations:
      - Describe
      - Alter
      - Delete
      - Create
  - bindingscope: cluster
    bindwithresource: true
    allowedoperations:
    - resourcetype: Topic
      operations:
      - Delete
      - Describe
      - Create
      - DescribeConfigs
    - resourcetype: Cluster
      operations:
      - Create
      - DescribeConfigs
    - resourcetype: TransactionalId
      operations:
      - Describe
    - resourcetype: Group
      operations:
      - Describe
      - Delete
- name: ResourceOwner
  policies:
  - bindingscope: schema-registry-cluster
    bindwithresource: true
    allowedoperations:
    - resourcetype: Subject
      operations:
      - Delete
      - Read
      - Write
      - ReadCompatibility
      - AlterAccess
      - WriteCompatibility
      - DescribeAccess
- name: ResourceOwner
  policies:
  - bindingscope: ksql-cluster
    bindwithresource: true
    allowedoperations:
    - resourcetype: KsqlCluster
      operations:
      - Describe
      - AlterAccess
      - Contribute
      - DescribeAccess
      - Terminate
- name: CCloudRoleBindingAdmin
  policies:
  - bindingscope: root
    bindwithresource: false
    allowedoperations:
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: Organization
      operations:
      - AlterAccess
      - DescribeAccess
- name: CloudClusterAdmin
  policies:
  - bindingscope: cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: Topic
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: SupportPlan
      operations:
      - Describe
    - resourcetype: User
      operations:
      - Describe
      - Invite
    - resourcetype: ServiceAccount
      operations:
      - Describe
- name: EnvironmentAdmin
  policies:
  - bindingscope: ENVIRONMENT
    bindwithresource: false
    allowedoperations:
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: Environment
      operations:
      - Alter
      - Delete
      - AlterAccess
      - CreateKafkaCluster
      - DescribeAccess
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: NetworkConfig
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: SchemaRegistry
      operations:
      - All
    - resourcetype: NetworkRegion
      operations:
      - All
    - resourcetype: Deployment
      operations:
      - All
    - resourcetype: Topic
      operations:
      - All
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: User
      operations:
      - Describe
      - Invite
    - resourcetype: ServiceAccount
      operations:
      - Describe
    - resourcetype: SupportPlan
      operations:
      - Describe
- name: OrganizationAdmin
  policies:
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: Topic
      operations:
      - All
    - resourcetype: NetworkConfig
      operations:
      - All
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: Billing
      operations:
      - All
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: Deployment
      operations:
      - All
    - resourcetype: SchemaRegistry
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: CloudApiKey
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: SecuritySSO
      operations:
      - All
    - resourcetype: SupportPlan
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: ServiceAccount
      operations:
      - All
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: Environment
      operations:
      - All
    - resourcetype: NetworkRegion
      operations:
      - All
    - resourcetype: Organization
      operations:
      - Alter
      - CreateEnvironment
      - AlterAccess
      - DescribeAccess
    - resourcetype: User
      operations:
      - All
- name: ResourceOwner
  policies:
  - bindingscope: cloud-cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: CloudCluster
      operations:
      - Describe
  - bindingscope: cluster
    bindwithresource: true
    allowedoperations:
    - resourcetype: Topic
      operations:
      - Create
      - Delete
      - Read
      - Write
      - Describe
      - DescribeConfigs
      - Alter
      - AlterConfigs
      - DescribeAccess
      - AlterAccess
    - resourcetype: Group
      operations:
      - Read
      - Describe
      - Delete
      - DescribeAccess
      - AlterAccess
- name: DataDiscovery
  policies:
  - bindingscope: environment
    bindwithresource: false
    allowedoperations:
    - resourcetype: CatalogTagDefinition
      operations:
      - Read
    - resourcetype: Topic
      operations:
      - ReadCatalog
    - resourcetype: Subject
      operations:
      - Read
      - ReadCatalog
      - ReadCompatibility
    - resourcetype: CatalogBusinessMetadataDefinition
      operations:
      - Read
- name: DataSteward
  policies:
  - bindingscope: environment
    bindwithresource: false
    allowedoperations:
    - resourcetype: CatalogTagDefinition
      operations:
      - Read
      - Write
      - Delete
    - resourcetype: Topic
      operations:
      - ReadCatalog
      - WriteCatalog
    - resourcetype: Subject
      operations:
      - Delete
      - Read
      - ReadCatalog
      - ReadCompatibility
      - Write
      - WriteCatalog
      - WriteCompatibility
    - resourcetype: CatalogBusinessMetadataDefinition
      operations:
      - Read
      - Write
      - Delete
- name: CCloudRoleBindingAdmin
  policies:
  - bindingscope: root
    bindwithresource: false
    allowedoperations:
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: Organization
      operations:
      - AlterAccess
      - DescribeAccess
- name: CloudClusterAdmin
  policies:
  - bindingscope: cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: Topic
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: SupportPlan
      operations:
      - Describe
    - resourcetype: User
      operations:
      - Describe
      - Invite
    - resourcetype: ServiceAccount
      operations:
      - Describe
- name: EnvironmentAdmin
  policies:
  - bindingscope: ENVIRONMENT
    bindwithresource: false
    allowedoperations:
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: Environment
      operations:
      - Alter
      - Delete
      - AlterAccess
      - CreateKafkaCluster
      - DescribeAccess
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: NetworkConfig
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: SchemaRegistry
      operations:
      - All
    - resourcetype: NetworkRegion
      operations:
      - All
    - resourcetype: Deployment
      operations:
      - All
    - resourcetype: Topic
      operations:
      - All
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: User
      operations:
      - Describe
      - Invite
    - resourcetype: ServiceAccount
      operations:
      - Describe
    - resourcetype: SupportPlan
      operations:
      - Describe
- name: OrganizationAdmin
  policies:
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: Topic
      operations:
      - All
    - resourcetype: NetworkConfig
      operations:
      - All
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: Billing
      operations:
      - All
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: Deployment
      operations:
      - All
    - resourcetype: SchemaRegistry
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: CloudApiKey
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: SecuritySSO
      operations:
      - All
    - resourcetype: SupportPlan
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: ServiceAccount
      operations:
      - All
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: Environment
      operations:
      - All
    - resourcetype: NetworkRegion
      operations:
      - All
    - resourcetype: Organization
      operations:
      - Alter
      - CreateEnvironment
      - AlterAccess
      - DescribeAccess
    - resourcetype: User
      operations:
      - All
- name: ResourceOwner
  policies:
  - bindingscope: cloud-cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: CloudCluster
      operations:
      - Describe
  - bindingscope: cluster
    bindwithresource: true
    allowedoperations:
    - resourcetype: Topic
      operations:
      - Create
      - Delete
      - Read
      - Write
      - Describe
      - DescribeConfigs
      - Alter
      - AlterConfigs
      - DescribeAccess
      - AlterAccess
    - resourcetype: Group
      operations:
      - Read
      - Describe
      - Delete
      - DescribeAccess
      - AlterAccess
- name: CCloudRoleBindingAdmin
  policies:
  - bindingscope: root
    bindwithresource: false
    allowedoperations:
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: Organization
      operations:
      - AlterAccess
      - DescribeAccess
- name: CloudClusterAdmin
  policies:
  - bindingscope: cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: Topic
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: SupportPlan
      operations:
      - Describe
    - resourcetype: User
      operations:
      - Describe
      - Invite
    - resourcetype: ServiceAccount
      operations:
      - Describe
- name: EnvironmentAdmin
  policies:
  - bindingscope: ENVIRONMENT
    bindwithresource: false
    allowedoperations:
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: Environment
      operations:
      - Alter
      - Delete
      - AlterAccess
      - CreateKafkaCluster
      - DescribeAccess
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: NetworkConfig
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: SchemaRegistry
      operations:
      - All
    - resourcetype: NetworkRegion
      operations:
      - All
    - resourcetype: Deployment
      operations:
      - All
    - resourcetype: Topic
      operations:
      - All
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: User
      operations:
      - Describe
      - Invite
    - resourcetype: ServiceAccount
      operations:
      - Describe
    - resourcetype: SupportPlan
      operations:
      - Describe
- name: OrganizationAdmin
  policies:
  - bindingscope: organization
    bindwithresource: false
    allowedoperations:
    - resourcetype: Topic
      operations:
      - All
    - resourcetype: NetworkConfig
      operations:
      - All
    - resourcetype: SecurityMetadata
      operations:
      - Describe
      - Alter
    - resourcetype: Billing
      operations:
      - All
    - resourcetype: ClusterApiKey
      operations:
      - All
    - resourcetype: Deployment
      operations:
      - All
    - resourcetype: SchemaRegistry
      operations:
      - All
    - resourcetype: KsqlCluster
      operations:
      - All
    - resourcetype: CloudApiKey
      operations:
      - All
    - resourcetype: NetworkAccess
      operations:
      - All
    - resourcetype: SecuritySSO
      operations:
      - All
    - resourcetype: SupportPlan
      operations:
      - All
    - resourcetype: Connector
      operations:
      - All
    - resourcetype: ClusterMetric
      operations:
      - All
    - resourcetype: ServiceAccount
      operations:
      - All
    - resourcetype: Subject
      operations:
      - All
    - resourcetype: Cluster
      operations:
      - All
    - resourcetype: Environment
      operations:
      - All
    - resourcetype: NetworkRegion
      operations:
      - All
    - resourcetype: Organization
      operations:
      - Alter
      - CreateEnvironment
      - AlterAccess
      - DescribeAccess
    - resourcetype: User
      operations:
      - All
- name: ResourceOwner
  policies:
  - bindingscope: cloud-cluster
    bindwithresource: false
    allowedoperations:
    - resourcetype: CloudCluster
      operations:
      - Describe
  - bindingscope: cluster
    bindwithresource: true
    allowedoperations:
    - resourcetype: Topic
      operations:
      - Create
      - Delete
      - Read
      - Write
      - Describe
      - DescribeConfigs
      - Alter
      - AlterConfigs
      - DescribeAccess
      - AlterAccess
    - resourcetype: Group
      operations:
      - Read
      - Describe
      - Delete
      - DescribeAccess
      - AlterAccess
