Group owner with a bounded token

Use case: a department head or group owner manages the settings of the groups they own — and nothing else. The group access token declares its authority boundary with bound_to, and the role enforces it locally: an in-bounds declaration converges over REST and GraphQL through the default api preset, while an out-of-bounds declaration is refused with a named error before any request is sent. Rails is deliberately excluded because it executes with instance authority and cannot honor a group token's boundary.

ansible-playbook -i localhost, examples/group-owner.yml

Source: examples/group-owner.yml

---
# Persona: department head / group owner.
# Scope: settings on the groups they own, applied with a group-owner token.
#
#   ansible-playbook -i localhost, examples/group-owner.yml
#
# REST and GraphQL are both selected through the default `api` preset. Rails
# is intentionally excluded because it executes with instance authority and
# cannot enforce this group's token boundary.
- name: Converge group settings
  hosts: localhost
  gather_facts: false
  connection: local
  vars:
    gitlab_settings_target:
      url: https://gitlab.example.com
      auth:
        type: group_access_token
        token: "{{ vault_group_owner_token }}"
        bound_to:
          resource: group
          identifier: platform
    gitlab_settings_backend: api
  tasks:
    - name: Apply group settings
      ansible.builtin.include_role:
        name: primetheus.gitlab_settings
        tasks_from: apply
      vars:
        gitlab_settings_resource: groups
        gitlab_settings_groups:
          - path: platform
            permissions:
              project_creation_level: maintainer
            push_rules:
              reject_unsigned_commits: true
              prevent_secrets: true
            protected_branches:
              - name: main
                allowed_to_push:
                  - access_level: maintainer
                allowed_to_merge:
                  - access_level: developer
            labels:
              - name: security
                color: "#d9534f"
            # GraphQL-only (served automatically under api):
            compliance_frameworks:
              - name: SOC2
                description: SOC 2 controls
                color: "#1f75cb"
                default: true
            custom_emoji:
              - name: shipit
                url: https://cdn.example.com/emoji/shipit.png
            dependency_proxy:
              enabled: true
            dependency_proxy_ttl_policy:
              enabled: true
              ttl: 30