fleetworks / warden / features / scoped-tokens
Scoped API tokens
Machine callers use wl_ PATs that carry an explicit scope list and an optional pin to one resource.
A PAT belongs to a service account, a machine identity owned by your organization. Org admins issue and revoke them; the console calls them API tokens.
Each PAT lists the actions it may perform, from a closed set of scopes, and can be restricted to one resource type and id. A PAT can never mint another token with more than it holds.
A PAT with no scopes is a legacy token: only its role governs it, and scope-gated endpoints refuse it.
More features
All features →- 01
Workspace records
List, create and update the Terraform Cloud workspaces your organization owns, each mapped to a service, an AWS account and a repo.
- 02
Org-scoped access
Every read is limited to the caller’s organization; roles and a chmod-style Perm mode decide who may change what.
- 03
Deterministic config Review
A fixed rule set checks a stored workspace, PAT or webhook endpoint and reports findings with a severity and a stable rule id.