{
  "slug": "argo-cd-ui-auto-sync-toggle-uses-resource-action-ef04ba132adc",
  "title": "Argo CD UI auto-sync toggle uses resource action",
  "tools": [
    "argocd"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-08-04T08:35:57.000Z",
  "announced_at": "2026-08-04T08:35:57.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When a role needs to toggle auto-sync from the application details page without broad application update permission, grant the `toggle-auto-sync` action and application `get` access for the target application.",
    "examples": [
      "p, role:oncall, applications, action/argoproj.io/Application/toggle-auto-sync, */*, allow\np, role:oncall, applications, get, */*, allow"
    ],
    "gotchas": [
      "Version: v3.5.0",
      "applications (required): RBAC resource for Application-specific policies.",
      "action/argoproj.io/Application/toggle-auto-sync (required): Action policy path, in `action/<group>/<kind>/<action-name>` form.",
      "get (required): Allows reading the target application.",
      "*/* (required): Application object pattern used in the example policy; application policy objects use `<app-project>/<app-name>`.",
      "Prerequisite: Configure SSO or one or more local users before defining additional RBAC roles.",
      "The `toggle-auto-sync` resource action was added earlier and is wired into the application details page by this change."
    ]
  },
  "why_it_matters": "Allow a role to toggle application auto-sync without granting broad application update permission.",
  "before": "The auto-sync checkbox called `updateApp`, requiring broad `application update` permission.",
  "sources": [
    "https://github.com/argoproj/argo-cd/releases/tag/v3.5.0",
    "https://github.com/argoproj/argo-cd/pull/27226",
    "https://github.com/argoproj/argo-cd/blob/v3.5.0/docs/operator-manual/rbac.md"
  ],
  "rank": 0.98027,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-656f1cd605543c63-32:gate",
    "evidence_hash": "07be7454f1632122a2ab9cf03b6223f667e5b8c46a3233bb371b89fc1a018727"
  },
  "review": {
    "draft_hash": "73bd36ee7c97d359aa845059df6b534a094a598b2768376e706d79db608a7868",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.65 (>= 0.6 needed)."
  }
}