2 files changed, 9 insertions, 1 deletions
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java
index 89f0a3c3382..f8b4d4171a4 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/PathGroup.java
@@ -19,6 +19,10 @@ import java.util.Set;
  */
 enum PathGroup {
 
+    /** Paths exclusive to operators (including read), used for system management. */
+    classifiedOperator(Optional.of("/api"),
+                       "/configserver/v1/{*}"),
+
     /** Paths used for system management by operators. */
     operator("/controller/v1/{*}",
              "/flags/v1/{*}",
@@ -228,6 +232,10 @@ enum PathGroup {
         return EnumSet.allOf(PathGroup.class);
     }
 
+    static Set<PathGroup> allExcept(PathGroup... pathGroups) {
+        return EnumSet.complementOf(EnumSet.copyOf(List.of(pathGroups)));
+    }
+
     /** Returns whether this group matches path in given context */
     boolean matches(URI uri, Context context) {
         return get(uri).map(p -> {
diff --git a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/Policy.java b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/Policy.java
index db7dd5909b3..e0341d76950 100644
--- a/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/Policy.java
+++ b/controller-api/src/main/java/com/yahoo/vespa/hosted/controller/api/role/Policy.java
@@ -115,7 +115,7 @@ enum Policy {
 
     /** Read access to all information in select systems. */
     classifiedRead(Privilege.grant(Action.read)
-                            .on(PathGroup.all())
+                            .on(PathGroup.allExcept(PathGroup.classifiedOperator))
                             .in(SystemName.main, SystemName.cd, SystemName.dev)),
 
     /** Read access to public info. */