Argo CD RBAC Default Policy Access Limits

Argo CD manages permissions through the argocd-rbac-cm ConfigMap, where the policy.default setting determines the baseline permissions for users who do not have an explicitly assigned role.

When integrating with external OIDC providers, there is a potential for ambiguity regarding how the system handles authenticated users who belong to no defined groups or roles. If the default policy is not strictly defined, there is a risk of granting unintended access to the management console.

• How does the policy.default setting behave when an OIDC provider successfully authenticates a user but provides no group memberships?
• What is the most restrictive value for policy.default to ensure that authenticated users have zero permissions until explicitly granted a role?