Audit logs and access Recommended

Keep roles as code

Define which job gets which role in a file in the repository, apply it from there, and change access only through a reviewed pull request.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Write a role matrix that maps each job to its roles in each system. Apply it with infrastructure code, such as Terraform for the cloud and the code host. The pull request history then shows who asked for access, who approved it and when. The quarterly review reads the same matrix.

Example

support-agent:
  admin-tool: [read-orders, refund-under-100]
  helpdesk: [agent]
engineer:
  code-host: [write]
  cloud: [read-only]
  database: []

How to check

A daily job compares the live roles in each system with the matrix and fails on any difference.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code.