Permissions and operation safety

Lumen uses the identity in the selected kubeconfig context. Grant only resources and verbs needed for the task. Namespace listing, Nodes, cluster-scoped RBAC and CRD discovery can be denied while namespace-scoped Pod inspection still works.

Reads include list/get/watch for displayed resources, Pod logs, Events, metrics APIs and Helm release Secrets. Writes are a smaller explicit set: selected workload operations, resource apply/delete, debug containers, Helm operations, Argo CD/Tekton actions and access-management flows.

Global read-only mode, context protection, timed unlocks, dry-run and confirmation checks reduce mistakes but never replace Kubernetes RBAC or admission. A successful dry-run cannot promise controller/runtime success.

Source: docs/OPERATOR_SAFETY.md, src/lib/contextProtection.ts, src-tauri/src/k8s/rbac_admin.rs, src-tauri/src/commands/k8s.rs at v0.18.0.