---
id: rbac-off
name: "Capability: no RBAC objects when disabled (OFF)"
description: >-
  Renders the product chart with rbac.create=false and asserts zero RBAC-kind objects (ServiceAccount, Role, ClusterRole, RoleBinding, ClusterRoleBinding) in the render. Since the chart has no RBAC templates at all, no RBAC objects are ever emitted regardless of the rbac.create value. This scenario is EXPECTED to PASS — confirming no RBAC objects leak when the knob is off.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.30.0
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    rbac.create: false
asserts:
  - type: rbac-objects
    namespace: sample
    source: rendered
    expect_present: false
tags: [capability, compliance]
category: capability
capability: rbac-toggle
tier: capability
mechanisms: ["capability:rbac"]