Manage Roles

What it does

When your agent uses it

• Asked to manage access control
• Check permissions
• Create custom roles
• Review RBAC configuration

Example prompts

• “/manage-roles”

Requirements

• Compatibility (from SKILL.md): Requires Harness MCP v2 server (harness-mcp-v2)

Workflow steps

6 steps, taken from the step headings in SKILL.md.

1. 1Understand Requirements
2. 2List Existing Roles
3. 3Check Current Assignments
4. 4List Available Permissions (for custom roles)
5. 5Create Custom Role (if needed)
6. 6View Resource Groups

What it can do on your machine

Read from SKILL.md and the folder at commit c25faee. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md.

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Requires Harness MCP v2 server (harness-mcp-v2)

  From compatibility in the SKILL.md frontmatter.

Context cost

Manage Roles loads about 1.5k tokens when it runs, and up to ~2.2k if it reads all its reference files. Until then it costs about 138 tokens; SKILL.md has 479 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~138

When it runs · the whole SKILL.md, loaded when a task matches

~1.5k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~2.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from harness/harness-skills at commit c25faee, republished under its Apache-2.0 licence (© harness). 479 words, ~1,517 tokens.

name

manage-roles

description

Manage Harness RBAC roles, role assignments, permissions, and resource groups via MCP v2 tools. List, create, update, and delete custom roles. View role assignments and permissions for users, groups, and service accounts. Use when asked to manage access control, assign roles, check permissions, create custom roles, review RBAC configuration, onboard users, or audit access. Trigger phrases: manage roles, RBAC, role assignment, user permissions, access control, custom role, resource group, who has access, grant access, revoke access.

compatibility

Requires Harness MCP v2 server (harness-mcp-v2)

metadata.author

Harness

metadata.version

1.0.0

metadata.mcp-server

harness-mcp-v2

license

Apache-2.0

harness_list(
  resource_type="role",
  org_id="<org>",           # optional
  project_id="<project>",   # optional
  search_term="<keyword>"   # optional
)

harness_list(
  resource_type="role_assignment",
  org_id="<org>",
  project_id="<project>"
)

harness_list(resource_type="permission")

harness_create(
  resource_type="role",
  org_id="<org>",
  project_id="<project>",
  body={
    "identifier": "custom_deployer",
    "name": "Custom Deployer",
    "description": "Can execute pipelines and view services",
    "permissions": [
      "core_pipeline_execute",
      "core_pipeline_view",
      "core_service_view",
      "core_environment_view"
    ]
  }
)

harness_list(resource_type="resource_group", org_id="<org>", project_id="<project>")

/manage-roles
Show me all roles available in the payments project

/manage-roles
List all role assignments with admin privileges in the default org

/manage-roles
Create a custom role called "release-manager" that can execute pipelines,
view services and environments, but cannot edit anything

/manage-roles
What roles does jane.smith@company.com have across all projects?

/manage-roles
Show me all resource groups and what they include

© harness, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/manage-roles of harness/harness-skills.

• SKILL.md
• references/builtin-roles.md

Open the folder on GitHubat commit c25faee