Two hundred operators, each with a hand-written permission document restating the same grants — that estate drifts one edit at a time, and "who can issue through the DMZ?" becomes archaeology. goca's answer: name the permission set once, and let identities join it.
# Group / pki-ops roles: [ra-operator] templates: ["*"] cas: [ica-tls] interfaces: ["RestEndpoint/web"] # AccessBinding / alice groups: [pki-ops]
Two hundred operators become two hundred one-line bindings against a handful of groups. "Who can issue through the DMZ interface?" is the group's member list. The semantics are deliberately small: effective permission is the union of an identity's groups (* anywhere collapses that axis); roles from membership resolve at login, so removal takes effect at the next sign-in; a binding is either membership or the legacy inline grant, never both; and groups do not nest — "why does this person have this" must fit in a sentence.
You don't start from an empty page: first boot seeds four groups — enrollment operators, CA operators, template authors, auditors — all editable and deletable, and never overwritten over your edits. Writing a Group needs system-admin: it grants to every member.
Now I can grant access by naming a set once, instead of restating it two hundred times.