--- a/compiled/complete/manifests/app-deployer-clusterrole.yaml
+++ b/compiled/complete/manifests/app-deployer-clusterrole.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    name: app-deployer
+  name: app-deployer
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/namespace-reader-clusterrole.yaml
+++ b/compiled/complete/manifests/namespace-reader-clusterrole.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    name: namespace-reader
+  name: namespace-reader
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/namespace-reader-clusterrolebinding.yaml
+++ b/compiled/complete/manifests/namespace-reader-clusterrolebinding.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    name: namespace-reader
+  name: namespace-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: namespace-reader
+subjects:
+  - kind: ServiceAccount
+    name: ci-deployer
+    namespace: shop
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: developers
--- a/compiled/complete/manifests/payments-namespace.yaml
+++ b/compiled/complete/manifests/payments-namespace.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    name: payments
+    pod-security.kubernetes.io/enforce: restricted
+  name: payments
--- a/compiled/complete/manifests/payments/app-deployer-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/app-deployer-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: app-deployer
+  name: app-deployer
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: app-deployer
+subjects:
+  - kind: ServiceAccount
+    name: ci-deployer
+    namespace: shop
--- a/compiled/complete/manifests/payments/config-reader-role.yaml
+++ b/compiled/complete/manifests/payments/config-reader-role.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    name: config-reader
+  name: config-reader
+  namespace: payments
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/payments/config-reader-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/config-reader-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: config-reader
+  name: config-reader
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: config-reader
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: User
+    name: jane@example.com
--- a/compiled/complete/manifests/payments/payments-edit-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/payments-edit-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: payments-edit
+  name: payments-edit
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: payments-team
--- a/compiled/complete/manifests/payments/payments-secrets-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/payments-secrets-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: payments-secrets
+  name: payments-secrets
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: secret-reader
+subjects:
+  - kind: ServiceAccount
+    name: deployer
+    namespace: payments
--- a/compiled/complete/manifests/payments/secret-reader-role.yaml
+++ b/compiled/complete/manifests/payments/secret-reader-role.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    name: secret-reader
+  name: secret-reader
+  namespace: payments
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/shop/app-deployer-rolebinding.yaml
+++ b/compiled/complete/manifests/shop/app-deployer-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: app-deployer
+  name: app-deployer
+  namespace: shop
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: app-deployer
+subjects:
+  - kind: ServiceAccount
+    name: ci-deployer
+    namespace: shop