Introduction

In CodeArts Pipeline, permissions are controlled at three layers from top to bottom to manage user behavior of different modules and granularities.

Layer	Module	Description
Tenant (all accounts)	Extensions, tenant-level policies, tenant-level rules, and pipeline templates	Controls resources of all modules under a tenant. It is configured in IAM and takes effect in all projects of the tenant.
Project	Pipeline, project-level policy, microservice, change	Controls module resources of a specific project. You can configure it in project settings. The configuration takes effect for all resources of the entire project.
Resource	Pipeline	Controls the operation permission of a specific pipeline. The permission can be configured by project member or role in the pipeline editing state.