GitOps role gets 403 on `GET /api/latest/fleet/software/titles` when software exception enabled

[kc9wwh]

Fleet versions

• Discovered: v4.84.0
• Reproduced: Not yet reproduced

Web browser and operating system: N/A

---

💥 Actual behavior

An API-only user with the gitops role receives 403 Forbidden when calling GET /api/latest/fleet/software/titles.

The endpoint handler ListSoftwareTitles in server/service/software_titles.go authorizes against AuthzSoftwareInventory with ActionRead:

if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{
    TeamID: opt.TeamID,
}, fleet.ActionRead); err != nil {
    return nil, 0, nil, err
}

The rego policy in server/authz/policy.rego only grants read on software_inventory to admin, maintainer, technician, observer, and observer_plus. gitops is not in the list, so the request is denied.

🛠️ Expected behavior

The gitops role should be able to read software_inventory (list software titles).

The fix is to add gitops to the allowed roles for software_inventory read in server/authz/policy.rego, both at the global and team scope, and update the role-based access guide to reflect the new permission.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Create an API-only user with the gitops global role
2. Generate an API token for that user via fleetctl
3. Call GET /api/latest/fleet/software/titles with the GitOps token in the Authorization: Bearer <token> header.
4. Observe a 403 Forbidden response instead of the expected list of software titles.

🕯️ More info (optional)

Cross-check against the role-based access guide confirms the documented behavior matches the policy: the "View all software" row in the user permissions table has no checkmark for GitOps. So the docs and code agree — but the design itself is the problem, since it leaves GitOps unable to reconcile software state.

Related authz code:

• server/service/software_titles.go — endpoint handler with the AuthzSoftwareInventory + ActionRead check
• server/authz/policy.rego — software_inventory block, lines under ## Software

[kc9wwh]

@georgekarrv requesting P2 on this as it blocks customer promise #20907.