Agent skill · software engineering · jeremylongshore
glean-enterprise-rbac
Map AD/Okta groups to Glean document permissions using allowedGroups.
Why this skill is useful
Adds executable scripts for managing document permissions and role assignments in Glean that are not publicly documented.
What it needs
Requires bash installed locally. Requires glean account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Glean Enterprise RBAC Overview Glean's enterprise search aggregates content from dozens of connectors (Google Drive, Confluence, Slack, Salesforce). RBAC ensures users only see documents they are authorized to access. Permissions flow from source systems through connector-level ACLs into Glean's unified index. Misconfigured permissions mean search results leak sensitive data across teams. SOC 2 and GDPR compliance require document-level access control and full audit trails on who searched what. Role Hierarchy Role Permissions Scope ------ ------------ ------- Super Admin Create API tokens, manage all connectors, configure SSO Organization-wide Admin Add/edit datasources, manage user groups, view analytics Assigned datasources Content Manager Set document permissions, manage allowedGroups per datasource Own datasources User Search and view permitted documents Documents matching ACLs Viewer Search only, no document previews or snippets Restricted document set Permission Check Role Assignment Audit Logging RBAC Checklist [ ] Each connector maps source-system ACLs to Glean allowedGroups [ ] API tokens scoped per datasource, not organization-wide [ ] SAML/SSO groups synced with Glean user groups daily [ ] Document-level permissions verified after each connector sync [ ] Search analytics reviewed monthly for unauthorized access patterns [ ] Token rotation policy enforced quarterly [ ] Sensitive datasources restricted to named allowedGroups only Error Handling Issue Cause Fix ------- ------- ----- User sees documents from wrong team AllowedGroups not mapped to connector Reconfigure connector ACL mapping in admin console 403 Forbidden on search API Expired or wrong-scope API token Regenerate token with correct datasource scope Stale permissions after IdP change Connector sync lag Trigger manual resync from Glean admin Missing search results Overly restrictive allowedGroups Audit group membership against source system ACLs Prerequisites A source-of-truth group inventory, nam …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/glean-enterprise-rbac--560338