Auto-grant parent (or home) workspace owner ownership permissions for child workspaces?

[ncdc]

Scenario:

• In Bob's home workspace root:users:bob, he grants Alice the ability to create child workspaces
• Alice creates a child workspace root:users:bob:alice
• Alice is automatically granted cluster-admin permissions in this new workspace
• Bob has no permission in root:users:bob:alice by default, but he could grant himself access unless Alice grants some to him (EDIT: I was wrong...)

Do you all think this is a problem?

Should we consider modifying the workspace creation logic in the server to also grant the typical ownership permissions to possibly some combination of

• the parent workspace's owner
• the home workspace's owner
• all the workspace owners from the parent all the way up to the home workspace's owner?

Should we consider doing anything similar for non-home workspaces?

[stevekuznetsov]

Isn't the RBAC for accessing the contents of root:users:bob:alice defined in root:users:bob, so Bob can give himself access?

[ncdc]

You're right, it is.