get_subject_permissions
Retrieve effective RBAC permissions for a Kubernetes subject. See bindings, rules, and associated pods to assess privilege and blast radius.
Instructions
Get the effective RBAC permissions of a Kubernetes subject (ServiceAccount, User, or Group) — what can this principal do across the cluster. Returns: the bindings that grant access (each pointing at its Role/ClusterRole), a deduplicated flat rule list, and (for ServiceAccounts) the Pods running as this SA. Use this to answer 'is this SA over-privileged?', 'why can X do Y?', or 'what's the blast radius if this Pod is compromised?'. For ServiceAccount, namespace is required. For User/Group, omit namespace (those are external identities, not namespaced resources). Inherited grants from implicit group memberships (system:authenticated, system:serviceaccounts) are included for ServiceAccount subjects with the inheritedFromGroup field set per binding so you can distinguish direct from inherited grants.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | subject kind: ServiceAccount, User, or Group | |
| namespace | No | namespace (required for ServiceAccount, omit for User/Group) | |
| name | Yes | subject name |