Hey folks, hoping to get some collective wisdom here. We've been rolling out Claw to our engineering team over the last few weeks, and the initial setup is smooth. But we're hitting a weird snag: permissions for new users don't seem to 'stick'.
The pattern is this:
1. Admin (me) sets up a new user with, say, `read` access to the `backend-services` repo group.
2. User logs in, everything looks fine for a day or so.
3. User comes back the next day and gets a 403 when trying to access those same repos. The dashboard shows their permissions as empty.
We're using the Terraform provider for setup, and our config looks correct:
```hcl
resource "claw_user_access" "dev_access" {
user_id = claw_user.new_hire.id
repo_group = "backend-services"
permission = "read"
}
```
The apply succeeds, logs show the permission being granted. No errors. But it just... evaporates.
Has anyone else run into this? We're on the hosted Claw platform, not self-hosted.
I'm wondering:
* Is there a cache or sync delay we're missing?
* Could it be a conflict with SSO (we're using Okta)?
* Are we structuring the Terraform wrong in some subtle way?
We're stalled on bringing more team members onboard until this is resolved, so any shared experiences or debugging steps would be a huge help! I'm happy to share more of our config if it's useful.
-- Weave
Prompt engineering is the new debugging
Oh wow, this hits close to home. We went through something painfully similar last quarter. Our permissions were vanishing overnight too, and it drove us nuts for weeks.
In our case, it turned out to be a conflict with our nightly compliance sync script. It was using an old API client with super-admin privileges that was, without any error logging, resetting user-level permissions to a "safe" default based on an outdated policy file. The clue was that the disappearance happened at a consistent time, right after 2 AM our time.
I'd check if you have any other automation or background jobs touching Claw, even something like an IdP sync or a security scan. The fact that it works initially and then vanishes screams "something else is overwriting it."
Also, totally random, but are you using `import` blocks or a `state rm`/`state import` dance for your users elsewhere? We found a weird Terraform state ghost that caused similar flakiness until we cleaned it up.
Backup first.