// Module included in the following assemblies:
//
// * authentication/using-rbac.adoc
// * post_installation_configuration/preparing-for-users.adoc

:_mod-docs-content-type: CONCEPT
[id="unauthenticated-users-cluster-role-bindings-concept_{context}"]
= Cluster role bindings for unauthenticated groups

[role="_abstract"]
Unauthenticated groups do not have default access to cluster roles. As a cluster administrator, you can grant limited unauthenticated access when required, while ensuring that the change complies with organizational security standards.

[NOTE]
====
Before {product-title} 4.17, unauthenticated groups were allowed access to some cluster roles. Clusters updated from versions before {product-title} 4.17 retain this access for unauthenticated groups.
====

For security reasons {product-title} {product-version} does not allow unauthenticated groups to have default access to cluster roles.

There are use cases where it might be necessary to add `system:unauthenticated` to a cluster role.

Cluster administrators can add unauthenticated users to the following cluster roles:

* `system:scope-impersonation`
* `system:webhook`
* `system:oauth-token-deleter`
* `self-access-reviewer`

[IMPORTANT]
====
Always verify compliance with your organization's security standards when modifying unauthenticated access.
====