Title: Allow user to update/delete certain policies(Hashicorp Vault)
Tags: hashicorp-vault;vault
Question: Description
I am using Hashicorp's Vault ,version 1.7.0, free version.
I would like to allow a certain range of policies that a user can assign/delete to a group. In that way he can add or delete entities user to the group from the UI.
What I have done
Bellow is written into blocks the overall policy file.
```{
capabilities = [&quot;list&quot;]
}

#To show the identity endpoint from the UI
path &quot;/identity/*&quot;{
 capabilities = [&quot;list&quot; ]
}

#policies that I would like the user to have the ability to #assign to the group.

path &quot;/sys/policies/acl/it_team_leader&quot;{
capabilities = [&quot;read&quot;, &quot;update&quot;, &quot;list&quot;]
}

path &quot;sys/policies/acl/it_user&quot;{
capabilities = [&quot;read&quot;, &quot;update&quot;,&quot;list&quot;]
}

path &quot;sys/policies/acl/ui_settings&quot;{
capabilities = [&quot;read&quot;, &quot;update&quot;, &quot;list&quot;]
}

path &quot;sys/policies/acl/personal_storage&quot;{
capabilities = [&quot;read&quot;, &quot;update&quot;,&quot;list&quot;]
}

#Group id that the user have full access

path &quot;/identity/group/id/2c97485a-754f-657a-5a8b-62b08a3ce8cb&quot; {

capabilities = [&quot;sudo&quot;,&quot;read&quot;,&quot;update&quot;,&quot;create&quot;,&quot;list&quot;]
}


```
What is the issue
Lets assume that I have an super-privileged policy that provides access to the the whole secret engine.
From the UI I am able to assign to that group the super-priveleged policy and basically allow a restricted user to assign this super policy to the whole group.
When I extended the policy with :
```path &quot;sys/policies/acl/**super-priveleged**&quot; {
capabilities = [&quot;deny&quot;]
}

```
is just restricting the policy to be read from the UI.
Appending the group path with allowed_parameters such us :
```
capabilities = [&quot;sudo&quot;,&quot;read&quot;,&quot;update&quot;,&quot;create&quot;,&quot;list&quot;]
denied_parameters = {
&quot;policies&quot; = [&quot;it_user&quot;,&quot;it_team_leader&quot;,etc]

}
```
I receive a permission denied error(403).
Appending with denied parameters :
```path &quot;/identity/group/id/2c97485a-754f-657a-5a8b-62b08a3ce8cb&quot; {

capabilities = [&quot;sudo&quot;,&quot;read&quot;,&quot;update&quot;,&quot;create&quot;,&quot;list&quot;]
denied_parameters = {
&quot;policies&quot; = [&quot;super-policy&quot;]

}
```
is not functioning and I am still allowed to assign the super policy.
I also tried wildcards with the same result.
Is it even possible to restrict one/a range of policies that can be assigned from the Vault UI?
Thanks in advance if you made it so far.



Here is another answer: Found the solution, to restrict user to update certain policies the allowed parameters fields should encapsulate a list and add an asterisk key with an empty list.
Note : The order of the policies assigned from the UI should comply with the order that is written in the .hcl file.
```path &quot;/identity/group/id/2c97485a-754f-657a-5a8b-62b08a3ce8cb&quot;
{

capabilities = [&quot;sudo&quot;,&quot;read&quot;,&quot;update&quot;,&quot;create&quot;,&quot;list&quot;]
allowed_parameters = {
&quot;policies&quot; = [[&quot;policy1&quot;,&quot;policy2&quot;,&quot;policy3&quot;]]
&quot;*&quot; = []
}
}
```


{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2021:00:08/17/21', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<hashicorp-vault><vault>', 'Title': 'Allow user to update/delete certain policies(Hashicorp Vault)', 'ViewCount': 449, 'id': 68820000, 'user_AboutMe': '', 'user_AccountId': 16832997.0, 'user_DisplayName': 'Vdoo', 'user_Reputation': 61.0, 'user_Views': 22.0, 'user_id': 12170459.0}}