Hierarchical Namespaces

In large enterprise environments, a flat list of projects is insufficient. You need a way to group projects by department, team, or business unit, and apply policies across those groupings. This is where Hierarchical Namespaces come in.

Multi-tenant Isolation

A namespace acts as an isolated tenant within your organization. Each namespace can have its own:

Projects and Environments
Access Policies (RBAC)
Transit Keys
Dynamic Secret Roles

Inheritance Model

Namespaces are hierarchical. You can create child namespaces within a parent namespace (e.g., Engineering/Backend or Engineering/Frontend).

🌲

Policy Inheritance

Policies and permissions flow downwards. A user granted "Admin" access at the Engineering namespace level will automatically have "Admin" access to all projects within Engineering/Backend and Engineering/Frontend.

This allows you to define global security policies at the root organization level, while allowing individual teams to manage their own specific access controls.

Managing Namespaces

You can manage namespaces through the RunEnv Dashboard or via the CLI:

runenv namespace create Engineering
runenv namespace create Engineering/Backend

To switch your current context to a specific namespace:

runenv namespace select Engineering/Backend