Every SMB share, every quota, every snapshot policy goes through a ticket and the same small storage team. There is a better way: delegate administration to the teams themselves — without ever handing them the keys to the cluster.
The real cost of the central service desk
A mid-sized organization generates dozens of storage requests a week — five-minute operations each. The visible cost is administrator time. The invisible cost is worse: every request waits in a queue, every wait slows a project, and teams end up working around you — USB drives, rogue shares, unapproved cloud. The central desk does not protect the cluster; it manufactures shadow IT.
What OneFS provides — and its limit
OneFS isolates tenants remarkably well at the platform level: each access zone has its own directory service, networks and tree, up to fifty zones per cluster. But administration remains centralized: there is no native “administrator of zone X only” role. Granting a team the right to create its shares requires privileges that expose far more than its zone.
The delegation model that works
The solution is an intermediate administration layer that enforces the confinement OneFS does not provide:
- Per-zone roles — a tenant administrator sees only their zones, across every cluster where they exist;
- A closed action perimeter — SMB shares, NFS exports, quotas (advisory, soft or hard) and snapshot schedules: the daily work, nothing more;
- A single service account to the cluster, with precisely defined privileges — delegated users never hold a OneFS account;
- A named audit log — who created what, when, in which zone: the condition under which security accepts delegation.
Implementation in four decisions
- Map zones to teams. One zone = one owner. Zones shared across teams are an exception to eliminate, not a pattern to tool around.
- Choose the delegation level. Start with quotas and snapshots (low risk, high demand); add shares and exports once trust is established.
- Plug in enterprise authentication. LDAP/Active Directory and two-factor: delegation must not create an island of local accounts.
- Measure. Delegated actions per month is your return on investment — every action is a ticket that never existed.
The classic objections, answered
“They will break everything.” The closed perimeter makes anything not explicitly allowed impossible; and the audit log turns every mistake into a traceable lesson rather than a mystery. “Security will refuse.” Present delegation as a privilege reduction: today, doing the work requires broad access; tomorrow, nobody — not even IT — will use an over-privileged account to create a share.