Enable group-scoped author permissions for Runbooks, so that users with Author role can view, create, and edit only the Runbooks assigned to their group(s) instead of having visibility to all Runbooks across the platform.

Current Behavior

In Cloud Pak for AIOps Runbooks:

When Runbook Groups are enabled:

• Users with View/User roles can only see Runbooks assigned to their groups.
• Users with Author role (and above) bypass group filtering and can see all Runbooks across all groups, regardless of group assignment.

When Runbook Groups are disabled:

• All users can see all Runbooks.

This behavior is by design and aligns with the current RBAC implementation, where Author is treated as an elevated administrative role.

Problem Statement

Large enterprise customers with multiple teams authoring Runbooks (multi-team or multi-tenant style usage) face challenges with the current model:

• Runbook Authors:
  • Can unintentionally see and edit Runbooks belonging to other teams
  • Risk modifying or overwriting Runbooks that they do not own
• Group assignments lose effectiveness once Author role is granted
• Customers cannot enforce team-level logical isolation for Runbook authoring

This creates operational risk, especially in regulated environments (e.g., banking) where separation of duties and ownership boundaries are critical.

Customer Use Case (Isbank Example)

• Multiple teams independently author and maintain Runbooks
• Each team owns a dedicated Runbook Group
• Teams want:
  • Authors to create and manage Runbooks only within their assigned group(s)
  • No visibility or edit access to Runbooks owned by other teams
• Goal:
  • Avoid accidental edits
  • Improve governance
  • Achieve practical multi-tenancy within Runbooks

Requested Enhancement

Introduce an optional permission model that allows Author role to respect group boundaries, such as:

• Group-Scoped Author Mode
  • Authors can:
    • Create Runbooks only within assigned groups
    • Edit and view Runbooks only in their groups
  • Authors do not see Runbooks outside their group assignment

Benefits

• Enables true multi-team / multi-tenant Runbook usage
• Reduces risk of accidental changes
• Improves governance and segregation of duties
• Aligns with enterprise security and compliance expectations
• Maintains backward compatibility by making the behavior optional

Conclusion

This enhancement would provide flexible, enterprise-grade access control for Runbooks while preserving the existing RBAC model. It would significantly improve adoption and safe usage of Runbooks in multi-team environments.