feat: add roles RBAC governance config to Bifrost Helm chart and config schema

[BearTS]

Summary

Adds support for declarative RBAC role definitions in the Bifrost governance configuration. This allows roles to be defined in config (or Helm values) and automatically created or updated on startup when the config hash changes, without affecting system roles or dashboard-managed roles.

Changes

• Added roles array support to the governance section of _helpers.tpl, mapping each role's name, description, dac, access_profile, and permissions fields into the rendered config
• Added roles to the governance presence check so the config block is included when roles are defined
• Added roles schema definition to values.schema.json with validation for all supported fields, including the dac enum (own-data, team-data, all-data) and the permissions array requiring resource and operation
• Added commented-out example role configuration to values.yaml under bifrost.governance.roles
• Added roles schema to transports/config.schema.json with full field descriptions, including DAC scope semantics, access profile linking, and supported permission resources and operations

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Deploy Bifrost via Helm with a roles entry defined under bifrost.governance.roles:

bifrost:
  governance:
    roles:
      - name: "data-analyst"
        description: "Read-only access for data analysts"
        dac: "team-data"
        access_profile: "analyst-profile"
        permissions:
          - resource: "Logs"
            operation: "View"
          - resource: "Metrics"
            operation: "View"

Verify that:

1. The rendered Helm template includes the roles block under governance
2. On startup, the defined roles are created or updated in the system
3. Existing system roles and dashboard-created roles are not deleted

helm template bifrost ./helm-charts/bifrost -f your-values.yaml | grep -A 20 "roles"

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

Role definitions control RBAC permissions including data access scope (dac) and resource-level operations. Ensure that roles defined in config are reviewed carefully before deployment, as misconfigured permissions could grant unintended access to sensitive resources such as AuditLogs, Users, or ModelProvider.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• New Features
  • Governance roles configuration now supported: define roles with required name and optional description, data-access scope (DAC), access profile, and granular permissions (resource + operation).
• Documentation
  • Configuration schema and Helm values updated with validation rules and commented role examples to guide deployment and validation.

[coderabbitai]

Warning

Review limit reached

@BearTS, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 32 minutes and 24 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9d95c2f2-fa6d-46ce-8c90-35e8a3be555e

📥 Commits

Reviewing files that changed from the base of the PR and between d371efc and c82069e.

📒 Files selected for processing (4)

• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml
• transports/config.schema.json

📝 Walkthrough

Walkthrough

Adds governance role definitions to Helm values and transport schema and updates the Helm helper to render governance.roles from configured values when present.

Changes

Governance Roles Configuration

Layer / File(s)	Summary
Role configuration schemas helm-charts/bifrost/values.schema.json, transports/config.schema.json	Defines the roles array and role object shape (required name; optional description, dac with enum/default, access_profile; permissions[] of {resource, operation}) with additionalProperties: false.
Helm values and template rendering helm-charts/bifrost/values.yaml, helm-charts/bifrost/templates/_helpers.tpl	Adds bifrost.governance.roles to values.yaml with commented examples; bifrost.config helper maps values into role objects and treats $governance.roles as a non-empty trigger so governance is emitted when roles exist.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• akshaydeo

Poem

🐰
I hopped through schema, leaf and role,
Wove names and rights into one scroll,
From values.yaml to templated song,
Permissions lined, the config strong,
A tiny rabbit guards the config whole.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding RBAC role governance config support to the Bifrost Helm chart and config schema.
Description check	✅ Passed	The PR description covers all required template sections including summary, detailed changes, type of change, affected areas, testing instructions, security considerations, and checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-03-feat_update_config_schemas_and_helm

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Confidence Score: 5/5

Safe to merge — all changes are additive schema and template definitions with no Go code modifications.

The change is purely additive: new schema fields, a Helm template rendering block, and a validation helper. The roles rendering in _helpers.tpl follows the same conditional-optional-field pattern as every other governance entity (business_units, virtualKeys), the presence check correctly uses the internal dict key $governance.roles, and the JSON schemas enforce name as required with dac constrained by enum and additionalProperties: false. No existing behavior is altered.

No files require special attention.

Important Files Changed

Filename	Overview
helm-charts/bifrost/templates/_helpers.tpl	Adds roles block rendering (name required, optional fields conditional) and a fail-fast name validation, consistent with how other governance entities like business_units and virtualKeys are handled. Presence check updated correctly with $governance.roles key.
helm-charts/bifrost/values.schema.json	Adds a well-formed roles array schema with name required, dac constrained by enum, and additionalProperties: false on both the role object and permission items. Consistent with the rest of the governance schema.
helm-charts/bifrost/values.yaml	Adds roles: [] default (falsy in Go templates, matching teams/virtualKeys patterns) with commented-out example entries. Also adds an unrelated OAuth MCP client example comment in the mcpClients section.
transports/config.schema.json	Adds roles as the config source-of-truth schema under governance, with descriptive documentation for each field, dac enum, and additionalProperties: false on permission items. Consistent with the upstream Helm schema.

_{Reviews (4): Last reviewed commit: "feat: update config schemas and helm" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/templates/_helpers.tpl`:
- Around line 446-457: The template only sets $governance.roles when
.Values.bifrost.governance.roles is truthy, so an explicit empty roles list is
omitted; modify the helper to emit an explicit empty list when the operator
intends no roles by ensuring that when .Values.bifrost.governance exists but
.Values.bifrost.governance.roles is nil/empty you still call set $governance
"roles" (append or assign an empty list via list) so config.json contains
"roles": []; update the block around the existing usage of
.Values.bifrost.governance.roles, $roles, and the $_ := set $governance "roles"
call and apply the same change at the other occurrence referenced (lines
509-510) to provide a definite presence signal for an empty roles array.

In `@helm-charts/bifrost/values.schema.json`:
- Around line 1140-1169: The roles schema's role object (the "items" object
defining role properties) is missing "additionalProperties": false—add that to
the role object definition; likewise add "additionalProperties": false to the
nested "permissions" item object (the object with "resource" and "operation");
and set the "dac" property (the property with enum
["own-data","team-data","all-data"]) to include "default": "all-data" so the
Helm values validation matches transports/config.schema.json.

In `@transports/config.schema.json`:
- Around line 608-655: The roles array currently only enforces that each item
has a name but not that names are unique; update the "roles" array schema to
enforce uniqueness of the "name" field (e.g., add the array-level uniqueness
constraint supported by our validator such as "uniqueItemProperties": ["name"]
for the "roles" schema) so duplicate governance.roles[].name values are rejected
during config.json validation; adjust any schema metadata/comments and run
schema validation tests to confirm duplicates now fail.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5495f73e-0d2b-4c3c-9260-150e032385e1

📥 Commits

Reviewing files that changed from the base of the PR and between f415c14 and 1c1720d.

📒 Files selected for processing (4)

• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml
• transports/config.schema.json

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/values.yaml`:
- Around line 529-540: The Helm values example for "roles" lacks the lifecycle
note that roles are create/update-only (no deletion); update the commented
example under the roles: [] block to mirror the schema wording: explicitly state
that governance roles are created/updated on startup when the config hash
changes and are not deleted via Helm (removing a role from values does not
delete it), and mention system/dashboard roles are never deleted; reference the
roles block and ensure the note matches the schema/lifecycle language used
elsewhere.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: eb38f849-0123-437a-811e-0ca21d5da0b3

📥 Commits

Reviewing files that changed from the base of the PR and between 1c1720d and 03d94f7.

📒 Files selected for processing (4)

• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml
• transports/config.schema.json

[BearTS]

• feat: add per_user_oauth to MCP connection authType enum in Bifrost Helm chart schema #4009
• feat: add roles RBAC governance config to Bifrost Helm chart and config schema #4004 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/templates/_helpers.tpl`:
- Around line 446-457: Add template-time validation for
.Values.bifrost.governance.roles inside the bifrost.validate template (after the
virtualKeys validation) to ensure each role object contains a required name
field; iterate over .Values.bifrost.governance.roles and emit a fail message via
the Helm tpl/fail pattern if any role is missing .name, referencing the same
keys used in the helper that builds roles (bifrost.governance.roles, role.name)
so validation matches the role construction logic in _helpers.tpl.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 09666a6c-8b0f-42ad-a458-f1a5328c3909

📥 Commits

Reviewing files that changed from the base of the PR and between 03d94f7 and d371efc.

📒 Files selected for processing (4)

• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml
• transports/config.schema.json

💤 Files with no reviewable changes (1)

• transports/config.schema.json

[akshaydeo]

Merge activity

• Jun 3, 6:55 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 3, 6:56 AM UTC: @akshaydeo merged this pull request with Graphite.