Currently you can associate a policy from another tenant to a user from your tenant. This is useful for default policies but has the disadvantage that nobody can “see” these default policies because there are not in their tenant

Proposition

#1 duplicate default policies in every tenant

pros: scoped by tenant

cons: duplicate the exact same object many time (some wazo-auth have more than 1700 tenants)

#2 add a “shared” attribute to default policies (or use config_managed)

pros: invisible to the user (because the policy still have the attribute config_managed that disallow to edit them)

cons: add logic inside wazo-auth to handle the shared column

Conclusion

Will go with #2

2020-04-15:

We should exposed a new attribute (ex: config_managed or read_only) to allow a UI to make logic because these policies cannot be updated/deleted

We should also restrict update/delete default_policies even on master tenant (because after restart, these policies will be re-updated/re-created)