Access model

Experimental: role bindings are not a substitute for independently validated network and cluster isolation.

v0.2 console authorization is role-based, not organization-scoped. There is no FleetOrg tenancy, pool quota model, or org-admin / customer product path in the current seed roles.

Role	Intended responsibility
dc-admin	Full platform administration
viewer	Read-only fleet views
site-admin	Site, cluster, FleetApp, and chart library operations
cluster-admin	Cluster and FleetApp operations; chart library is read-only

FleetApp installs always name a cluster. Capability candidate filters help operators choose; there is no placement engine.

All public management access must pass through authenticated fleet-console-auth. Design and verify network, storage, registry, and Kubernetes isolation separately before sharing a hub across untrusted parties.

See console auth for roles and verification for operational checks.