---
title: "Keep roles as code · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep roles as code

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)
- Rule: Define which job gets which role in a file in the repository, apply it from there, and change access only through a reviewed pull request.
- How: Write a role matrix that maps each job to its roles in each system. Apply it with infrastructure code, such as Terraform for the cloud and the code host. The pull request history then shows who asked for access, who approved it and when. The quarterly review reads the same matrix.
- Check: A daily job compares the live roles in each system with the matrix and fails on any difference.

Example:

```yaml
support-agent:
  admin-tool: [read-orders, refund-under-100]
  helpdesk: [agent]
engineer:
  code-host: [write]
  cloud: [read-only]
  database: []
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code`.

- Previous: [Grant admin rights only for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin)
- [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)