Sub Access Graph entitlement by emargetis · Pull Request #63117 · gravitational/teleport

emargetis · 2026-01-23T23:16:47Z

Summary

This PR substitutes the now deprecated Policy entitlement for the new Access Graph entitlement. It also swaps out all usages in Teleport of Policy for Access Graph.

Note: The Access Graph entitlement has a structure of {Enabled: bool, Limit: num} while Policy only had {Enabled: bool}. While this PR is a 1:1 swap that only passes through the Enabled flag, the Limit value may want to be used in the future, 0 indicating a dedicated instance and 1 indicating a shared instance.

https://github.com/gravitational/teleport.e/pull/7898 will be similar to this PR

Merge order of PRs:

Supports https://github.com/gravitational/cloud/issues/16130

Manual Test Plan

Test Environment

I deployed a dev build with these changes alone to cloud staging (erik-ag-partial) and verified that toggling Access Graph from the SC UI provides and removes access in the product. Though you still need to roll the pods to see the expected UI.

Test Cases

Toggling on and rolling pods enables access graph
Toggling off and rolling pods disables access graph

Local Entitlement Testing

Prep

Check out this branch and the corresponding e branch
Create and run a local enterprise cloud tenant against a local salescenter instance
Add this print statement on the Teleport side in feature.go to verify entitlements received by Teleport:

fmt.Printf("DEBUG GetCloudFeatures: entitlements=%v\n", resp.Entitlements)

Test `AccessGraph` entitlement independently

Enabled

Add this code snippet just before the response from the handler and rebuild SC

// test AccessGraph entitlement works independently
e["Policy"] = &v1.EntitlementInfo{Enabled: false}

Toggle on the Access Graph feature for the tenant in the SC UI
Restart local tenant, visit the access graph page (/web/accessgraph), and verify you see the following error:

Verify in the Teleport logs that Policy was not enabled and AccessGraph was set to enabled:true in the response

Disabled

Toggle off Access Graph in the SC UI
Restart the tenant to make sure it has the latest license updates, visit the access graph page, and verify you see a trial ad instead of the error above:

Verify in the Teleport logs that Policy was not enabled and AccessGraph entitlement was not enabled in the response

Test `Policy` entitlement independently for backward compatibility (simulating old licenses)

Enabled

Replace the code snippet from the previous test in the handlerwith the following and rebuild SC:

// test Policy entitlement still works independently
e["AccessGraph"] = &v1.EntitlementInfo{Enabled: false}

Toggle on Access Graph in the SC UI
Restart local tenant, visit the access graph page (/web/accessgraph), and verify you see the same connection error again
Verify in the Teleport logs that AccessGraph was not enabled and Policy was set to enabled:true in the response

Disabled

Toggle off Access Graph in the SC UI
Restart the tenant to make sure it has the latest license updates, visit the access graph page, and verify you see the trial ad instead of the error above
Verify in the Teleport logs that AccessGraph was not enabled and Policy was not enabled in the response

zmb3

I didn't get all the way through the review, but I've noticed that there are some things that make this PR hard to understand.

It looks like we used to have a "feature" for TAG/Policy/AccessGraph, and then we switched to entitlements, but we also kept the feature for compatibility.

This means there are a bunch of places where we're checking both the feature and the entitlement.

Now we're adding a third thing to check (an additional entitlement). That's a lot of combinations to test and verify that everything is working correctly.

Entitlements have been out for long enough now that we should be able to simplify this by removing the features so the entitlement becomes a single source of truth.

What do you think?

entitlements/entitlements.go

api/client/webclient/webconfig.go

entitlements/entitlements.go

zmb3 · 2026-01-30T20:11:28Z

lib/auth/clusterconfig/clusterconfigv1/service.go

 	// If the policy feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
-	if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
+	if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {


I would update the comment here since it talks about the [deprecated] policy feature.

This if statement is also pretty hard to follow. I wonder if we can make it so that we can only check the AccessGraph entitlement here, and have the code that sets features handle the compatibility.

Unfortunately, right now the entitlement and feature serve somewhat unique purposes. The AccessGraph entitlement ensures the customer has access to the feature while the AccessGraph feature ensures the same AND that the TAG resource was connected (see code). I had a draft branch to decouple that feature but it's a bit more involved and not on the critical path for this PR.

lib/auth/clusterconfig/clusterconfigv1/service.go

lib/modules/modules.go

emargetis · 2026-03-05T13:38:29Z

Moving to draft while PR is rebased

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0d28b8d6f7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-12T21:22:06Z

lib/auth/clusterconfig/clusterconfigv1/service.go

-	// If the policy feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
-	if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
+	// If the access graph feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
+	if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {


Keep Policy fallback in Access Graph authz gates

This gate now ignores the legacy Policy entitlement, so a cluster with Policy=true, AccessGraph=false, and Features.AccessGraph=false will be treated as unlicensed and denied (GetClusterAccessGraphConfig returns disabled, and update/upsert/reset paths now return AccessDenied). That is a regression during the deprecation window because Policy is still carried in entitlements and other paths still treat it as valid compatibility input.

Useful? React with 👍 / 👎.

Features.AccessGraph will be updated to be enabled if either AccessGraph or Policy entitlement is enabled in e.#7898.

AccessGraph entitlementsis also enabled if either AccessGraph or Policy is enabled for self-hosted licenses (GetSelfHostedLicenseFeatures) and legacy licenses (setLegacyLogic) in the same file.

For cloud, no fallback is needed as it always sets AccessGraph and Policy to the same value here

lib/srv/discovery/access_graph_aws.go

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 115ab82766

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

lib/srv/discovery/access_graph_azure.go

lib/srv/discovery/access_graph_aws.go

emargetis force-pushed the erikmargetis/access-graph-entitlement branch from c7c444c to 4154e68 Compare January 23, 2026 23:41

emargetis changed the title ~~Replacing policy with access graph entitlement~~ Adding access graph entitlement Jan 26, 2026

emargetis force-pushed the erikmargetis/access-graph-entitlement branch 2 times, most recently from 9bdf0fd to a48bdf9 Compare January 28, 2026 04:55

emargetis changed the title ~~Adding access graph entitlement~~ Adding Access Graph entitlement Jan 28, 2026

emargetis marked this pull request as ready for review January 30, 2026 19:50

github-actions bot added discovery size/sm ui labels Jan 30, 2026

github-actions bot requested review from avatus and charlestp January 30, 2026 19:50

avatus requested a review from michellescripts January 30, 2026 19:55

charlestp approved these changes Jan 30, 2026

View reviewed changes

emargetis added the no-changelog Indicates that a PR does not require a changelog entry label Jan 30, 2026

zmb3 reviewed Jan 30, 2026

View reviewed changes

emargetis marked this pull request as draft March 5, 2026 13:38

emargetis changed the title ~~Adding Access Graph entitlement~~ Swapping Access Graph entitlement Mar 5, 2026

emargetis mentioned this pull request Mar 5, 2026

Add Access Graph Entitlement #64339

Closed

emargetis changed the title ~~Swapping Access Graph entitlement~~ Swap Access Graph entitlement Mar 5, 2026

emargetis changed the title ~~Swap Access Graph entitlement~~ Sub Access Graph entitlement Mar 5, 2026

emargetis mentioned this pull request Mar 5, 2026

Add access graph entitlement #64340

Merged

emargetis changed the base branch from master to erikmargetis/add-access-graph-entitlement March 5, 2026 22:51

emargetis force-pushed the erikmargetis/access-graph-entitlement branch from be45c44 to 7265e5f Compare March 5, 2026 23:34

emargetis force-pushed the erikmargetis/add-access-graph-entitlement branch from eed9a9b to be4ca92 Compare March 6, 2026 23:24

emargetis force-pushed the erikmargetis/access-graph-entitlement branch 2 times, most recently from d52cf07 to 0d28b8d Compare March 9, 2026 17:22

emargetis marked this pull request as ready for review March 12, 2026 21:14

github-actions bot requested review from kimlisa and rudream March 12, 2026 21:15

chatgpt-codex-connector bot reviewed Mar 12, 2026

View reviewed changes

Base automatically changed from erikmargetis/add-access-graph-entitlement to master March 12, 2026 21:47

emargetis added 2 commits March 12, 2026 14:57

adding access graph alongside policy

ae82d25

adding logic change from #64340

115ab82

emargetis force-pushed the erikmargetis/access-graph-entitlement branch from 0d28b8d to 115ab82 Compare March 12, 2026 21:58

michellescripts requested a review from tigrato March 12, 2026 22:03

chatgpt-codex-connector bot reviewed Mar 12, 2026

View reviewed changes

lib/srv/discovery/access_graph_azure.go Show resolved Hide resolved

lib/srv/discovery/access_graph_aws.go Show resolved Hide resolved

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sub Access Graph entitlement#63117

Sub Access Graph entitlement#63117
emargetis wants to merge 2 commits intomasterfrom
erikmargetis/access-graph-entitlement

emargetis commented Jan 23, 2026 •

edited

Loading

Uh oh!

zmb3 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zmb3 Jan 30, 2026

Uh oh!

emargetis Mar 12, 2026

Uh oh!

Uh oh!

Uh oh!

emargetis commented Mar 5, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 12, 2026

Uh oh!

emargetis Mar 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

emargetis commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Manual Test Plan

Test Environment

Test Cases

Local Entitlement Testing

Prep

Test AccessGraph entitlement independently

Enabled

Disabled

Test Policy entitlement independently for backward compatibility (simulating old licenses)

Enabled

Disabled

Uh oh!

zmb3 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zmb3 Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

emargetis Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

emargetis commented Mar 5, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

emargetis Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

emargetis commented Jan 23, 2026 •

edited

Loading

Test `AccessGraph` entitlement independently

Test `Policy` entitlement independently for backward compatibility (simulating old licenses)

emargetis Mar 13, 2026 •

edited

Loading