Workspace-Level Role-Based Access Control (RBAC)

Workspace-level RBAC controls which Creators can access specific workspaces and what they can do in them. This article covers managing workspace permissions, including adding Creators, changing permission levels, and removing access.

Two-Level Permission System

Creators need both environment and workspace permissions:

Combined Result: Contributor with CAN_EDIT in Finance can create and edit applications in Finance workspace.

Workspace Permission Levels

There are four workspace permission levels, listed in order of privilege:

CAN_MANAGE (Highest Privilege)

What it grants:

• View, create, edit, delete, and promote all workspace content.
• Update workspace settings.
• Manage workspace Creators and permissions (requires Administrator Creator Role).
• Full control over the workspace.

When to use: Workspace owners and project leads.

Managing workspace Creators and permissions requires the Administrator Creator Role (environment-level), not just CAN_MANAGE workspace permissions. Administrators automatically have at least CAN_MANAGE permissions on all workspaces.

CAN_EDIT

What it grants:

• View, create, edit, and delete workspace content.
• Manage data models.
• View shared library elements.
• Cannot promote content or manage Creators.

When to use: Active developers on the team.

CAN_VIEW (Lowest Access)

What it grants:

• Read-only access to workspace content.
• View library elements and data models.
• Cannot modify, promote, delete, or manage Creators.

When to use: Auditors, stakeholders, and reviewers.

NO_ACCESS (Explicit Restriction)

What it grants:

• No access to workspace content.
• Used to explicitly restrict a Creator whose Creator Role otherwise grants access.

When to use: Block access to sensitive workspaces.

Accessing Workspace Permissions

Navigation Path

1. Open the workspace to manage.
2. In the file explorer (left sidebar), locate the workspace row.
3. Select (ellipsis) for the workspace.
4. Select Permissions.

Permission Required: CAN_EDIT or higher for that workspace. The Permissions option displays for Creators with CAN_EDIT or CAN_MANAGE workspace permissions.

The dialog opens in read-only mode for non-Administrators. Creators with the Administrator Creator Role (environment-level) can add Creators, change permissions, or remove other Creators from the workspace.

Any Creator can remove themselves from a workspace using Leave Workspace.

User Permissions Dialog

The permissions dialog displays:

Header:

• Dialog title: [Workspace Name] Permissions (for example, "Finance Permissions").

Add Users Section (Administrators):

• Form to add new Creators.
• Select User(s) selector (multi-select, search by name or email).
• Permission selector.
• Email notification checkbox.
• This section displays for Creators with the Administrator Creator Role.

User List:

• Search bar to filter by name or email.

• List showing:

  • Creator name and email.
  • Permission level: editable selector for Administrators, read-only text for non-Administrators.
  • Service Creator indicator (key icon, tooltip: "This user is a credential").
  • An undo button (tooltip: Undo changes) when a change is pending but not saved (Administrators).
  • Action menu: each row displays either Delete (for other Creators, Administrators) or Leave Workspace (for the current Creator's own row, available to all).

• Empty state: "No Creators have been assigned to this workspace yet."

Action Buttons:

• Cancel: Always visible. Closes the dialog and discards any pending changes. Disabled while saving.
• Save Changes: Always visible; disabled when no changes are pending. Shows a count badge with the number of pending changes. Displays Saving… with a spinner while in progress.

Adding Creators to a Workspace

1. Open the User Permissions dialog.

2. Click the Select User(s) selector and search by name or email. Select or more Creators. Selected Creators display as chips; service Creators are marked with a key icon.

3. Click the Permission selector and select a level:

   • Can Manage.
   • Can Edit.
   • Can View (default).
   • No Access.

4. To notify added Creators by email, check Notify Creators by email. This option is available when the permission is not No Access.

5. Click Add. The form resets and the Creator list updates.

Creators with at least Creator Role assigned, not already in the workspace, and with active accounts display in the selector. If no eligible Creators exist, the selector displays "No Creators available."

All selected Creators receive the same permission level. Multiple Creators can be added simultaneously.

Changing Creator Permissions

1. In the User Permissions dialog, find the Creator using the search bar or by scrolling.
2. Click the Permission selector for that Creator and select a new level: Can Manage, Can Edit, Can View, or No Access. An undo button displays on the row. Repeat for additional Creators if needed.
3. Click Save Changes. All pending changes are saved simultaneously.

Changes are tracked locally and not saved until Save Changes is clicked.

Non-Administrators see permission levels as read-only text instead of editable selectors.

If some changes fail:

• Retry: Click Save Changes again to retry failed updates.
• Undo individual change: Click the undo button on the failed row to revert that Creator to the original permission and clear the inline issue.
• Discard all: Click Cancel to close the dialog and revert all pending changes.

Removing Creators from a Workspace

Removing a Creator

1. In the User Permissions dialog, find the Creator using the search bar or by scrolling.
2. Select (ellipsis) for the Creator and select Delete.

The Creator is removed immediately:

• The Creator is removed from the list.
• Any pending changes for that Creator are cleared.
• The Creator loses all access to the workspace.

Leaving a Workspace (Self-Removal)

Any Creator with CAN_EDIT or higher can remove themselves from a workspace, regardless of their Creator Role.

1. In the User Permissions dialog, find the Creator's own row in the Creator list.
2. Select (ellipsis) and select Leave Workspace.

The Creator is removed immediately and redirected to the home page:

• Access to the workspace is lost.
• The Creator must be re-added by an Administrator to regain access.

leave a workspace if access is no longer needed.

Special Cases

Service Creators (Credentials)

Service Creators can be added to workspaces like regular Creators:

• Marked with a key icon in the Creator selector and Creator list.
• Can have any workspace permission level.
• Used for API access and automation.

Changing Own Permissions

Creators can view their own row in the Creator list. The permission selector on that row is editable, but reducing self-permissions is not recommended; access to manage the workspace might be lost. Use Leave Workspace to remove workspace access entirely.

NO_ACCESS Permission

Setting a Creator to NO_ACCESS:

• Effectively removes them from the workspace.
• They remain in the Creator list with No Access. Unlike a full removal, this can be changed back to an access level.
• Setting a Creator to No Access restricts access temporarily without losing the Creator's workspace record.

Best Practices

1. Assign the Minimum Necessary Permission

• Begin with CAN_VIEW for new Creators.
• Grant CAN_EDIT to active developers.
• Reserve CAN_MANAGE for workspace owners and leads.
• Use No Access to explicitly restrict instead of not adding Creators.

2. Use Batch Operations

• Add multiple Creators simultaneously when a team.
• Change multiple permissions together before saving.
• Reduces API calls and saves time.

3. Communicate Permission Changes

• Enable email notifications when adding Creators.
• Inform Creators when reducing their permissions.
• Document permission decisions for audit trails.

4. Review Permissions Regularly

• Audit workspace Creators periodically.
• Remove Creators who no longer need access.
• Check for Creators with elevated permissions they do not use.

5. Maintain Multiple Creators with Can Manage

• Have at least two Creators with Can Manage per workspace.
• Prevents workflow disruption if Creator leaves or loses access.
• Ensures workspace settings and content promotion can continue.

6. Test Before Removing Critical Creators

• Verify resources are not owned solely by the Creator being removed.
• Check for workflows or integrations tied to that Creator.
• Coordinate removal with team members.

7. Use Search to Manage Large Teams

• Filter by name or email to find specific Creators quickly.
• Reduces scrolling through long lists.
• Makes batch updates more efficient.

Troubleshooting

Issue: Cannot Access Creator Permissions Dialog

Possible Causes:

• The Creator does not have CAN_EDIT or CAN_MANAGE permission for this workspace.

Solution:

• Ask an Administrator to grant CAN_EDIT or CAN_MANAGE workspace access.
• Contact an Administrator for environment-level Creator Role access.

Issue: Creator Not Displaying in Add Creators List

Possible Causes:

• The Creator is already in the workspace.
• The Creator has no Creator Role assigned.
• The Creator's account is inactive or deleted.

Solution:

• Check if the Creator already displays in the Creator list.
• Verify the Creator has at least Creator Role assigned in Creator (User) Administration.
• Confirm the Creator's account is active.

Issue: Permission Change Failed

Possible Causes:

• Network error or timeout.
• The Creator being changed is an Administrator; Administrators cannot be reduced below Can Manage (API-enforced).
• Invalid permission value.

Solution:

• Check the inline error message for the specific reason.
• Retry by clicking Save Changes again.
• Administrators must always have Can Manage.

Issue: Cannot Remove Creator

Possible Causes:

• The current Creator is not an Administrator.
• API error or network issue.
• The Creator being removed is an Administrator and cannot be removed.

Solution:

• Only Creators with the Administrator Creator Role can remove other Creators.
• Check the error message in the toast notification.
• Retry the deletion.
• Administrators have automatic CAN_MANAGE and cannot be removed through workspace permissions.

Issue: Changes Not Saving

Possible Causes:

• Lost network connection.
• Session expired.
• API server issue.

Solution:

• Check the browser console for issues.
• Refresh the page and try again.
• Contact support if the issue continues.