Limit admin secret visibility

note

Tier: Enterprise

Overview

By default, Passwd admins see all records in the workspace and can reveal their sensitive fields, such as a password or card number. In some organizations, being an admin should not mean being able to read everyone's credentials. This feature limits what admins can see, so an admin only reads the sensitive data that has been shared with them, like any other user.

An admin in an instance with this feature enabled is called a limited admin.

How it works

When the feature is enabled, a limited admin:

• Gets a limited view of records that are not shared with them. These records have the permission state limited: all sensitive fields are removed, such as passwords, card numbers and CVV, private keys, API credentials, 2FA secret keys, secure note text and passkeys.
• Sees every field of records that are shared with them or that they own, according to the role they were given.
• Cannot use "View as". An admin cannot list records as another user or group would see them, which would otherwise bypass the restriction.
• Cannot open the security audit report. The report shows the strength and age of individual passwords, so it is not available to limited admins.
• Gets no write access to vaults they are not a member of, nor to the records in them.

Everything else about the admin role stays the same. A limited admin can still manage users, roles, tags, workspace settings and groups.

note

An admin who needs to read a record can be given access to it, directly, through a group or through a vault, like any other user. The audit log shows who opened which record.

Admin compared to limited admin

	Admin (default)	Limited admin
Reveal sensitive fields of records not shared with them	Yes	No
Edit records not shared with them	Yes	No
Use "View as" another user or group	Yes	No
Open the security audit report	Yes	No
Manage users, roles, tags and settings	Yes	Yes

Enabling the feature

This feature is controlled through a build variable in Google Cloud Build:

1. Go to Google Cloud Console → Cloud Build → Triggers.
2. Select the passwd-pipeline trigger.
3. Add a new variable: _LIMIT_ADMIN_PERMISSIONS = true
4. Save and redeploy.

Notes

• By default, the variable is not set, meaning admins can view all fields as usual.
• Enabling the flag will apply to all environments where the pipeline is deployed.
• The setting is per instance. It cannot be changed in the Passwd app, and it applies to every admin of your organization.
• Before you enable it, make sure the right people already have access to your business-critical records. Admins can no longer open records that nobody has shared with them.