Cognite Function unscoped access to trigger function

​@Markus Pettersen I checked with the engineering team regarding this and there are no plans at the moment. I’ll convert this question to a product idea and you will hear back from the product team when there is an update on this.

🚀 Granular Access Control for Cognite Functions is Here!

We are excited to announce that the functions:run capability is now officially live! This update provides the granular layer of security and flexibility needed to manage your Cognite Functions at scale.

What’s New?

Previously, permissions were broader, requiring higher-level access (write) to execute functions. With the introduction of the specific run capability, you can now implement the principle of least privilege across your organization:

• Secure your CI/CD: Restrict functions:write exclusively to function developers. This ensures that only authorized pipelines can create, update, or delete code.

Empower your Users: Grant data consumers and analysts functions:read and functions:run. This allows them to discover and execute existing functions and view results without the risk of accidental deletions or unauthorized code changes.

Capability Breakdown

Here is how you can now structure your CDF Groups:

• Function Developers: functions:read, functions:write
• Consumers/Analysts: functions:read, functions:run

Why this matters

This update is a step towards improving the governance. By decoupling the ability to deploy from the ability to execute, you can safely open up your library of industrial functions to a wider audience while maintaining a "locked-down" production environment.

Get Started

You can start configuring these permissions today in the Access Management tab of your CDF project.

• Documentation: Cognite Functions Setup & Administration

Next Steps

We are planning to further improve the governance of functions by enabling the ability to scope access to specific sets of functions grouped together. This will help enterprises manage the access to their resources better.