mirror of https://github.com/coder/coder.git synced 2026-09-23 14:03:57 +08:00

Files

T

Steven Masley 52423eb87b feat: promote MinimumImplicitMember experiment to GA (#27472 )

Promotes the `minimum-implicit-member` experiment to GA and removes it.

## What changes

- The `minimum-implicit-member` experiment constant, its
`RoleOptions.MinimumImplicitMember` toggle, and the global
`rbac.MinimumImplicitMember()` accessor are deleted. The minimal-member
behavior is now the only behavior: `organization-member` and
`organization-service-account` carry only the floor (read-self records,
notifications, and similar) and grant **no workspace permissions**.
Workspace access lives exclusively on the
`organization-workspace-access` role.
- The experiment gate on customizing `default_org_member_roles` (`PATCH
/organizations/{org}`) is removed; the built-in-roles-only validation
remains.
- The dashboard's Default Roles section and the implied-roles display on
the members page are no longer experiment-gated.
- Admin docs: new "Default member roles" section in
`docs/admin/users/organizations.md`, cross-linked from
`groups-roles.md`.

## Why this is safe for existing deployments

Migration `000516` (shipped earlier) backfilled
`default_org_member_roles` with `['organization-workspace-access']` on
every organization. Members therefore keep exactly the effective
permissions they had with the experiment off; the workspace elevation
flows through the default role instead of being baked into
`organization-member`.

**Rollback caveat:** rolling back past this release restores the bundled
elevation, silently re-granting workspace access to members of
organizations that cleared their default roles.

## Review

Deep-review R1 findings are addressed in `chore: address deep-review
findings` (copy fixes, read-only Default Roles for viewers, removable
overlapping explicit grants, RBAC prose restoration, test
de-tautologizing, docs). Point-by-point disposition is in the PR
comments.

---

Generated by Coder Agents on behalf of @Emyrk.

2026-08-03 15:56:56 -05:00

4.3 KiB

Raw Blame History

Groups and Roles

Groups and roles can be manually assigned in Coder. For production deployments, these can also be managed and synced by the identity provider.

Groups

Groups are logical segmentations of users in Coder and can be used to control which templates developers can use. For example:

Users within the devops group can access the AWS-VM template
Users within the data-science group can access the Jupyter-Kubernetes template

Roles

Roles determine which actions users can take within the platform.

	Auditor	User Admin	Template Admin	Owner
Add and remove Users		✅		✅
Manage groups (premium)		✅		✅
Change User roles				✅
Manage ALL Templates			✅	✅
View ALL Workspaces			✅	✅
Update and delete ALL Workspaces				✅
Run external provisioners			✅	✅
Execute and use ALL Workspaces				✅
View all user operation Audit Logs	✅			✅

A user may have one or more roles. All users have an implicit Member role that may use personal workspaces.

Whether organization members can create and use workspaces is controlled per organization through its default member roles. See Default member roles for how to remove workspace operations from the default member set.

Custom Roles

Note

Custom roles are a Premium feature. Learn more.

Starting in v2.16.0, Premium Coder deployments can configure custom roles on the Organization level. You can create and assign custom roles in the dashboard under Organizations -> My Organization -> Roles.

Example roles

The Banking Compliance Auditor custom role cannot create workspaces, but can read template source code and view audit logs
The Organization Lead role can access user workspaces for troubleshooting purposes, but cannot edit templates
The Platform Member role cannot edit or create workspaces as they are created via a third-party system

Custom roles can also be applied to headless user accounts:

A Health Check role can view deployment status but cannot create workspaces, manage templates, or view users
A CI role can update manage templates but cannot create workspaces or view users

Creating custom roles

Clicking "Create custom role" opens a UI to select the desired permissions for a given persona.

From there, you can assign the custom role to any user in the organization under the Users settings in the dashboard.

Note that these permissions only apply to the scope of an organization, not across the deployment.

Security notes

A malicious Template Admin could write a template that executes commands on the host (or coder server container), which potentially escalates their privileges or shuts down the Coder server. To avoid this, run external provisioners.

In low-trust environments, we do not recommend giving users direct access to edit templates. Instead, use CI/CD pipelines to update templates with proper security scans and code reviews in place.

4.3 KiB Raw Blame History