intermediateSecurity: RBAC, Service Accounts & Pod Security Standards
Why is RBAC described as purely additive with no explicit deny?
A subject's effective permissions are the union of every Role/ClusterRole bound to it. There is no deny rule type. Anything not explicitly granted is denied by omission.
This is a Pro chapter
Sign in, then upgrade to Pro or Power to unlock this and the full DevOps Mastery library.
Why is RBAC described as purely additive with no explicit deny?