Public secrets exposure leads to supply chain attack on GitHub CodeQL

No mention why this temp token had rights to do things like create a new deployments and generate artifact attestations?

For their fix, they disabled debug logs...but didn't answer if they changed the temp tokens permissions to something more appropriate for a code analysis engine.

I think we all know this old story. The engineer building it was getting permission denied so they gave it all the permissions and never came back and right-sized.

Does any RBAC system actually tell you the missing permissions required to access the object in question? It’s like they’re designed to create this behavior

Yes. Most auth systems do to the developer - GCP & AWS IAM give particularly detailed errors; nearly every feature/permission system I have implemented did. However, it wouldn't be unusual for the full error to be wrapped or swallowed by some lazy error handling. Its a bit of a PITA but well worth it to translate to a safe and informative user facing error.

as a nit; RBAC is applied to an object based permissions system rather than being one. Simply, RBAC is a simplification of permission management in any underlying auth system.