Setting boundaries through access management and policy enforcement

Control and access control are very important aspects. Without considering them, we cannot design or implement the pipeline at scale. With modern CI/CD, when there are multiple teams involved in the delivery of software, it is important to consider proper security aspects and provide proper access controls in the CI/CD pipeline structure. It often starts from the beginning – who are the users or personas involved, and how and what are they going to use? It is also needed for regulatory and audit compliance purposes and, by design, the pipeline, platform, and components need to be secured against different threats.

In a typical pipeline, there are multiple teams and roles involved along with various components. Thus, it is necessary to define a clear boundary for each team and component to determine their functions and roles. In the following section, we will explore one of the most important concepts, called...