Cross-project trusts
A trust grants a user in one project temporary permission to act in another project — without that user needing membership or a shared API key. The trust carries a specific role, an expiration, and an optional impersonation scope.
The canonical use case: a CI/CD pipeline that's identified to project shared-infra but needs to deploy resources into acme-prod. Without trusts, you'd either give the CI key admin on both projects (bad blast radius) or copy keys between projects (worse). With a trust, shared-infra issues a time-bounded vms:write grant in acme-prod; the CI calls present the trust along with their normal credentials.
Trusts respect the security model — the granting user can only grant roles they themselves hold, and the trust expires no later than the grant they're delegating from. There's no privilege escalation path.
What's next
- Roles — what a trust delegates.
- Users and Projects — the endpoints of a trust.
- Security model — the wider context for IAM design.