Clarify that Projects do not restrict cross-Project Nexus calls

[LutaoX]

Summary

• Document that a Nexus Endpoint in one Project can still be invoked from a caller Namespace in another Project when that Namespace is on the Endpoint allowlist.
• Clarify that Project roles only control who can create, list, update, and delete the Endpoint resource.
• Note that unlike Connectivity Rules, the Endpoint, target Namespace, and caller Namespace do not have to share a Project.

Why

Field asked this on the Projects page (Slack). The page said Endpoints are Project-scoped and stopped there, so people inferred runtime isolation.

Test plan

• Confirm /cloud/projects#use-nexus-across-projects renders and is linked from the intro, Nexus overview, Nexus Registry, and Project permissions matrix.
• Confirm the CreateNexusEndpoint curl example still reads clearly with the target vs caller note.

Made with Cursor

[vercel]

@LutaoX is attempting to deploy a commit to the Temporal Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

🟡 Changes recommended

Conflicting Nexus Endpoint authorization guidance remains in related documentation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Clarifies that Projects govern Nexus Endpoint management but do not restrict allowlisted cross-Project calls.

Changes:

• Documents cross-Project Nexus access.
• Distinguishes management permissions from runtime authorization.
• Adds related documentation links.

File summaries

File	Review
docs/encyclopedia/nexus/nexus.mdx	Clarifies cross-Project runtime access.
docs/encyclopedia/nexus/nexus-registry.mdx	Adds Project-scoping guidance; its permissions table still presents a conflicting authorization model (nit).
docs/cloud/projects.mdx	Adds guidance and examples; related security, users, and Terraform pages retain conflicting role requirements (nit).
docs/cloud/manage-access/permissions-reference.mdx	Distinguishes management permissions from runtime access.

Review details

Suppressed comments (1)

docs/cloud/projects.mdx:207

• This Project-role model leaves conflicting authorization guidance elsewhere: docs/evaluate/temporal-cloud/security.mdx:90-91 still calls Endpoints account-scoped and requires Account Developer plus target Namespace Admin, while docs/cloud/manage-access/users.mdx:43 and docs/cloud/terraform-provider.mdx:303-304 repeat the target-Namespace requirement. Update those pages to the Project-role model documented here and in the Project permissions matrix.

- A Nexus Endpoint lives in one Project. That Project controls who can [create, list, update, and delete](/cloud/manage-access/permissions-reference#cloud-ops-api-permissions-2) the Endpoint.

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
temporal-documentation	Ready	Preview	Sep 4, 2026 5:57pm UTC

[LutaoX]

Closing in favor of #5252, opened from a branch on temporalio/documentation so Vercel can deploy the preview automatically.