[morgan-wowk]

Manage who can operate, edit or manage a saved pipeline from the run view. Cancel and Run Notes now follow the run scopes inherited from the pipeline, not only "you started this run".

Where to find it

The Manage pipeline access button sits in the v2 run view's actions bar, next to the run status. It appears only when the run came from a saved pipeline that the viewer holds some scope on. The access list is only readable by people it names, so anyone else doesn't see the button.

Dialog

Owner shares	Grant holder without share

operate grant: Cancel run (v2 run view)	No grant: no Cancel run, no access button (v2 run view)

This change is v2 only; the v1 run view is unchanged. All screenshots are from the v2 run view. They come from the oasis-frontend screenshot E2E against this branch (https://github.com/Shopify/oasis-frontend/pull/731).

Secrets stay with the owner

Edit changes everything except secrets. The backend refuses an editor's save that adds, swaps or removes a secret, changes a task that takes one, or changes an input such a task reads (https://github.com/Shopify/oasis-backend/pull/745). The UI points editors to the owner rather than letting them hit that error.

In the dialog, an editor who isn't the owner sees one line naming who to ask:

There's no UI on master that edits a saved pipeline yet, so the editor tips are shown in a throwaway PR built on the remote-pipeline work: #2857

Task with a secret	Adding a secret

UX

flowchart TD
  run["Run view"] --> ann{"run has pipeline-id annotation?"}
  ann -- no --> creator["creator-only Cancel and Notes, as before"]
  ann -- yes --> pscopes["GET my_scopes for the pipeline"]
  pscopes --> granted{"any scope?"}
  granted -- yes --> btn["Manage pipeline access button"]
  granted -- no --> nobtn["no button"]
  ann -- yes --> scopes["GET my_scopes for the run"]
  scopes --> cancel["Cancel shown with run:cancel"]
  scopes --> notes["Notes editable with run:annotate"]
  btn --> dialog["Manage access dialog"]
  dialog --> share{"caller has pipeline:share?"}
  share -- yes --> edit["edit rows, Save sends users and revision"]
  share -- no --> ro["read-only rows"]

Loading

API model

sequenceDiagram
  participant UI as tangle-ui
  participant API as oasis-backend
  participant DB as extra_data
  UI->>API: GET /api/access_control/pipeline/ID
  API->>DB: read access_control
  alt caller holds any scope
    API-->>UI: owner, users, history, revision, my_scopes, warning
  else no grant
    API-->>UI: 403
  end
  UI->>API: PUT /api/access_control/pipeline/ID with users and revision
  API->>DB: lock row, compare revision
  alt revision matches and caller has pipeline:share
    API->>DB: write users, append history entry
    API-->>UI: 200 with the new state
  else revision is stale
    API-->>UI: 409
  else no pipeline:share
    API-->>UI: 403
  end

Loading

Code lives in src/components/shared/AccessControl/. The other edits swap isRunCreator for canCancel and canAnnotate.

Scopes

Scope	Includes
operate	run:cancel, run:annotate
edit	operate, plus pipeline:update (rename included)
manage	edit, plus pipeline:delete, pipeline:share

Owners and admins hold every scope. Runs inherit run:* from their saved pipeline. Starting a run isn't a scope: anyone can run a saved pipeline, as on prod today.

Related

• tangle: Add per-resource access control primitives and run scopes tangle#387
• oasis-backend: https://github.com/Shopify/oasis-backend/pull/745
• oasis-frontend: https://github.com/Shopify/oasis-frontend/pull/732
• Editor tips (throwaway): [Throwaway] Editor secret tips on shared remote pipelines #2857

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: access-control-mvp/e166557

[morgan-wowk]

Closing for now. The UI work will be revisited later in new PRs; the backend changes continue in TangleML/tangle#387 and https://github.com/Shopify/oasis-backend/pull/745.