How can certain playbooks be restricted to admin role only?

• A. Add a filter block to restricted playbooks that filters for runRole - "Admin".
• B. Add a tag with restricted access to the restricted playbooks.
• C. Remove the Execute Playbook capability from all roles except admin.
• D. Place restricted playbooks in a second source repository that has restricted access.

Answer: (D)

Restricting access to certain playbooks is a critical aspect of managing security and permissions within a platform. When playbooks are placed in a second source repository that has restricted access, only authorized users, such as those in the admin role, can access and execute those playbooks. This method ensures that sensitive or critical operations can be tightly controlled and reduces the risk of unauthorized users executing potentially harmful or sensitive automation tasks.

By utilizing a separate repository, you can enforce access controls at the repository level, making it easier to manage who can see and interact with the playbooks. This approach streamlines permission management and supports the principle of least privilege, allowing only those users who should have access to these specific playbooks.

Other methods, such as adding filter blocks or tags, may provide some level of control but do not provide the same level of security as placing playbooks in a restricted repository. Simply removing capabilities from roles could lead to complexities and unintentional access issues, while tagging plays might not ensure the same degree of isolation from non-admin users.