palantir-enterprise-rbac

name	palantir-enterprise-rbac
description	Configure Palantir Foundry enterprise access control with project roles, markings, and service users. Use when implementing role-based access, configuring project permissions, or setting up service user accounts for Foundry integrations. Trigger with phrases like "palantir RBAC", "foundry roles", "palantir permissions", "foundry access control", "foundry service user".
allowed-tools	Read, Write, Edit
version	1.5.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","palantir","foundry","rbac","enterprise","security"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Palantir Enterprise RBAC

Overview

Configure enterprise-grade access control in Foundry: project roles (Viewer/Editor/Owner), organization-level groups, service user accounts for integrations, and marking-based data classification.

Prerequisites

• Foundry enrollment with admin access
• Understanding of Foundry project structure
• Familiarity with palantir-security-basics

Instructions

Step 1: Project Role Hierarchy

Role	Permissions	Use Case
Viewer	Read datasets, view Ontology objects	Analysts, stakeholders
Editor	Read/write datasets, run builds	Data engineers, developers
Owner	Full control, manage members, configure	Project leads, admins

Step 2: Create Service Users for Integrations

Developer Console > Applications > New Application:
1. Name: "order-sync-service" (descriptive of function)
2. Type: Server application (client credentials flow)
3. Scopes: api:read-data, api:ontology-read (minimum needed)
4. Project access: Add as Editor on specific projects only

Result: client_id + client_secret (store in secrets manager)

Step 3: Scope Matrix by Application

# Define per-application scopes
APP_SCOPES = {
    "dashboard-reader": ["api:read-data", "api:ontology-read"],
    "data-sync-service": ["api:read-data", "api:write-data"],
    "admin-tool": ["api:read-data", "api:write-data", "api:ontology-read", "api:ontology-write"],
}

def create_client_for_app(app_name: str) -> foundry.FoundryClient:
    scopes = APP_SCOPES[app_name]
    auth = foundry.ConfidentialClientAuth(
        client_id=os.environ[f"{app_name.upper().replace('-',)}_CLIENT_ID"],
        client_secret=os.environ[],
        hostname=os.environ[],
        scopes=scopes,
    )
    auth.sign_in_as_service_user()
     foundry.FoundryClient(auth=auth, hostname=os.environ[])