Not a maintainer, but in my own opinion: - `Application` is a special CRD. You can define one application to control namespaced resources in more than one name

Not a maintainer, but in my own opinion: - `Application` is a special CRD. You can define one application to control namespaced resources in more than one namespace, cluster-wide resources, or even resources in another cluster if the controller have access to that cluster. So how to implement secure access to applications is a difficult organization/management problem (and not necessarily a technical problem). - I don't know why the project decided to implement its own RBAC, but I like that I can give some users limited visibility in some clusters without implementing k8s native RBAC for them. From a pure GitOps perspective, I treat it as an anti-feature because it enables a lot of imperative operations via its own API, bypassing git. But not all organizations are so comfortable to be 100% gitops, I think it's an acceptable middle ground. And I think you can deploy ArgoCD with reduced permission just fine. I heard some folks do that, although there might be some gotchas. If it's up to me, I would completely lock down its own API's access and just do everything from git, leaving the UI as read-only for informational purposes.