# 1.4 — ClusterRole (GREEN)

Phase: 1 — Atlas Core
Stage: GREEN

Depends on: [1.2](1.2-rbac-test.md)

- [ ] ClusterRole: verbs `get,list,watch` only, explicit resource list — no `secrets`, no `*`, no wildcard apiGroups

## Verify

```bash
kubectl auth can-i get secrets --as=system:serviceaccount:portfolio:atlas   # no
```