Workspace-Level Role-Based Access Control (RBAC)

Workspace-level RBAC controls which Creators can access specific workspaces and what they can do in them. This article covers managing workspace permissions, including adding Creators, changing permission levels, and removing access.

Two-Level Permission System

Creators need both environment and workspace permissions:

Combined Result: Contributor with CAN_EDIT in Finance can create and edit applications in Finance workspace only.

Workspace Permission Levels

There are four workspace permission levels, listed in order of privilege:

CAN_MANAGE (Highest Privilege)

What it grants:

• View, create, edit, delete, and promote all workspace content.
• Update workspace settings.
• Manage workspace Creators and permissions.
• Full control over the workspace.

When to use: Workspace owners and project leads.

CAN_EDIT

What it grants:

• View, create, edit, and delete workspace content.
• Manage data models.
• View shared library elements.
• Cannot promote content or manage Creators.

When to use: Active developers on the team.

CAN_VIEW (Lowest Access)

What it grants:

• Read-only access to workspace content.
• View library elements and data models.
• Cannot modify, promote, delete, or manage Creators.

When to use: Auditors, stakeholders, and reviewers.

NO_ACCESS (Explicit Restriction)

What it grants:

• No access to workspace content.
• Used to explicitly restrict a Creator whose Creator Role otherwise grants access.

When to use: Block access to sensitive workspaces.

Accessing Workspace Permissions

Navigation Path

1. Open the workspace to manage.
2. From the Definition drop-down, select Permissions.

Permission Required: CAN_MANAGE for that workspace.

Note: Default workspaces without an owner cannot have permissions managed.

User Permissions Page

The page displays:

Header:

• Workspace name.

Add Users Section:

• Form to add new Creators.
• Select User(s) selector (multi-select, search by name or email).
• Permission drop-down.
• Email notification checkbox.

User List:

• Search bar to filter by name or email.
• Table showing:
  • Creator name and email.
  • Permission level drop-down.
  • Service User indicator (key icon, tooltip: "This user is a credential").
  • An undo button (tooltip: Undo changes) when a change is pending but not saved.
  • Action menu: each row shows either Delete (for other Creators) or Leave Workspace (for the current Creator's own row).
• Empty state: "No users have been assigned to this workspace yet."

Action Buttons:

• Save Changes: Always visible; disabled when no changes are pending. Shows a count badge with the number of pending changes. Displays Saving… with a spinner while in progress.
• Discard Changes: Displays only when changes are pending. Reverts all pending changes.

Adding Users to a Workspace

1. Navigate to the User Permissions page.
2. Click the Select User(s) selector and search by name or email. Select one or more Creators. Selected Creators display as chips; service users are marked with a key icon.
3. Click the Permission drop-down and select a level:
   • Can Manage.
   • Can Edit.
   • Can View (default).
   • No Access.
4. To notify added Creators by email, check Notify users by email. This option is only available when the permission is not No Access.
5. Click Add. The form resets and the user list updates.

Note: Only Creators with at least one Creator Role assigned, not already in the workspace, and with active accounts display in the selector. If no eligible Creators exist, the selector shows "No users available."

All selected Creators receive the same permission level. Multiple Creators can be added at once.

Changing User Permissions

1. On the User Permissions page, find the user using the search bar or by scrolling.
2. Click the Permission drop-down for that Creator and select a new level: Can Manage, Can Edit, Can View, or No Access. An undo button displays on the row. Repeat for additional Creators if needed.
3. Click Save Changes. All pending changes are saved at once.

Note: Changes are tracked locally and not saved until Save Changes is clicked.

If some changes fail:

• Retry: Click Save Changes again to retry failed updates.
• Undo individual change: Click the undo button on the failed row to revert that Creator to the original permission and clear the inline issue.
• Discard all: Click Discard Changes to revert all pending changes.

Removing Users from a Workspace

Removing a User

Step 1: Locate the User

1. On the User Permissions page, find the Creator to remove. Use search if needed.
2. Select for the Creator and select Delete.
3. A confirmation dialog titled Remove User displays: "Are you sure you want to remove [user name] from this workspace?" Click Remove to confirm.

Result:

• The Creator is removed from the list immediately.
• Any pending changes for that Creator are cleared.
• The Creator loses all access to the workspace.

Leaving a Workspace (Self-Removal)

Step 1: Open Your Action Menu

1. Locate the current Creator's row in the user list, select and select Leave Workspace.
2. A confirmation dialog displays: "Are you sure you want to leave this workspace? You will lose access to all applications in this workspace." Click Leave to confirm.

Result:

• The Creator is redirected to the workspaces list.
• Access to the workspace is lost immediately.

Important: Only leave a workspace if access is no longer needed. Another Creator with Can Manage will need to re-add the Creator.

Special Cases

Service Users (Credentials)

Service users can be added to workspaces like regular Creators:

• Marked with a key icon in the user selector and user list.
• Can have any workspace permission level.
• Used for API access and automation.

Default Workspaces

Default workspaces without an owner:

• Do not have a User Permissions page.
• Cannot have permissions managed.
• Display an access denied message instead.

Changing Your Own Permissions

Creators can view their own row in the user list. The permission drop-down on that row is editable, but reducing self-permissions is not recommended; access to manage the workspace may be lost. Use Leave Workspace to remove workspace access entirely.

NO_ACCESS Permission

Setting a Creator to NO_ACCESS:

• Effectively removes them from the workspace.
• They remain in the user list with No Access. Unlike a full removal, this can be changed back to an access level.
• Use this to restrict access temporarily without losing the Creator's workspace record.

Best Practices

1. Assign the Minimum Necessary Permission

• Begin with CAN_VIEW for new Creators.
• Grant CAN_EDIT only to active developers.
• Reserve CAN_MANAGE for workspace owners and leads.
• Use No Access to explicitly restrict instead of not adding Creators.

2. Use Batch Operations

• Add multiple Creators at once when onboarding a team.
• Change multiple permissions together before saving.
• Reduces API calls and saves time.

3. Communicate Permission Changes

• Enable email notifications when adding Creators.
• Inform Creators when reducing their permissions.
• Document permission decisions for audit trails.

4. Review Permissions Regularly

• Audit workspace Creators periodically.
• Remove Creators who no longer need access.
• Check for Creators with elevated permissions they do not use.

5. Maintain At Least Two Can Manage Creators

• Always have at least two Creators with Can Manage.
• Prevents lockout if one Creator leaves or loses access.
• Ensures someone can manage permissions if needed.

6. Test Before Removing Critical Creators

• Verify resources are not owned solely by the Creator being removed.
• Check for workflows or integrations tied to that Creator.
• Coordinate removal with team members.

7. Use Search to Manage Large Teams

• Filter by name or email to find specific Creators quickly.
• Reduces scrolling through long lists.
• Makes batch updates more efficient.

Troubleshooting

Issue: Cannot Access User Permissions Page

Possible Causes:

• The Creator does not have Can Manage permission for this workspace.
• This is a default workspace without an owner. Default workspaces display an access denied message: "Please contact your workspace administrator for access."

Solution:

• Ask a Creator with Can Manage to grant access.
• Contact an Administrator for environment-level access.
• Verify the workspace has an owner and is not a default workspace.

Issue: User Not Displaying in Add Users List

Possible Causes:

• The Creator is already in the workspace.
• The Creator has no Creator Role assigned.
• The Creator's account is inactive or deleted.

Solution:

• Check if the Creator already displays in the user list.
• Verify the Creator has at least one Creator Role assigned in Administration > Creator Permissions > Creator (User) Administration.
• Confirm the Creator's account is active.

Issue: Permission Change Failed

Possible Causes:

• Network error or timeout.
• The Creator being changed is an Administrator; Administrators cannot be reduced below Can Manage (API-enforced).
• Invalid permission value.

Solution:

• Check the inline error message for the specific reason.
• Retry by clicking Save Changes again.
• Administrators must always have Can Manage.

Issue: Cannot Remove User

Possible Causes:

• API error or network issue.
• The Creator is an Administrator and cannot be removed.

Solution:

• Check the error message in the toast notification.
• Retry the deletion.
• Administrators have automatic Can Manage and cannot be removed through workspace permissions.

Issue: Changes Not Saving

Possible Causes:

• Lost network connection.
• Session expired.
• API server issue.

Solution:

• Check the browser console for issues.
• Refresh the page and try again.
• Contact support if the issue continues.