---
id: rbac-off
name: "Capability: no RBAC objects when disabled (OFF)"
description: >-
  Renders the product chart with rbac.create=false and asserts zero RBAC-kind
  objects (ServiceAccount, Role, ClusterRole, RoleBinding,
  ClusterRoleBinding) in the render. Since the chart has no RBAC templates
  at all, no RBAC objects are ever emitted regardless of the rbac.create
  value. This scenario is EXPECTED to PASS — confirming no RBAC objects
  leak when the knob is off.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.36.1
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    rbac.create: false
asserts:
  - type: rbac-objects
    namespace: sample
    source: rendered
    expect_present: false
tags: [capability, compliance]
category: capability
capability: rbac-toggle
tier: capability
mechanisms: ["capability:rbac"]