> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.dify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Permission Templates

> Learn how to configure default workspace roles and resource permission level templates for new workspaces.

# Configure Permission Templates

Dify Enterprise provides admin-level RBAC templates to help organization administrators define the default permission structure for new workspaces.

Admin console templates do not directly change permissions in existing workspaces. They define the initial roles and resource permission levels that will be inherited when a new workspace is created.

## What You Can Configure

In the admin console, go to **Roles & Permissions**. You can configure two types of templates:

| Template                             | Purpose                                                                       |
| ------------------------------------ | ----------------------------------------------------------------------------- |
| **Workspace Role Templates**         | Defines the default workspace roles and their permissions for new workspaces. |
| **Resource Permission Set Template** | Defines the default resource permission levels available in new workspaces.   |

## Workspace Role Templates

Workspace role templates define what members can do in a workspace. When a new workspace is created, it inherits the roles configured in this template.

To open the page, go to **Admin Console → Roles & Permissions → Workspace Role Templates**.

The page lists all default workspace roles, including:

| Column          | Description                                                                      |
| --------------- | -------------------------------------------------------------------------------- |
| **Role**        | The role name.                                                                   |
| **Type**        | Indicates whether the role is a system preset role or an enterprise custom role. |
| **Description** | A short explanation of the role.                                                 |
| **Action**      | View, edit, or remove the role, depending on the role type.                      |

### System Preset Roles

System preset roles are built-in roles provided by Dify. They are used to keep permissions stable during upgrades and provide a reliable default role model for new workspaces.

Common system preset roles include:

| Role                  | Description                                                             |
| --------------------- | ----------------------------------------------------------------------- |
| **Owner**             | Full control of the workspace, including members, roles, and resources. |
| **Admin**             | Manages most workspace settings, members, roles, and resources.         |
| **Editor**            | Can create and edit apps, knowledge bases, and other content.           |
| **Normal**            | Can view and use assigned resources, but cannot manage them.            |
| **Restricted Member** | Has no default access to features or resources.                         |

System preset roles cannot be removed. Depending on your configuration, some fields or permissions may be read-only to protect upgrade compatibility.

### Enterprise Custom Roles

Enterprise custom roles are roles created by enterprise administrators. They can be used to define permission models that match your organization’s internal responsibilities.

You can:

* Create a custom role.
* Edit the role name, description, and permissions.
* Remove the role if it is no longer needed.

### Create a Role

1. Click **Create Role**.
2. Enter a role name.
3. Add a role description.
4. Select the permissions that should be granted to this role.
5. Click **Save**.

Permissions are grouped by product area, such as **Workspace** and **Application**. You can search for permissions or expand each permission group to select individual permission points.

### Edit a Role

1. Click **Detail** for the role you want to edit.
2. Review the role name, description, and selected permissions.
3. Update the editable fields.
4. Click **Save**.

For system preset roles, editable fields may be limited. For enterprise custom roles, you can update the role configuration based on your permission design.

### Remove a Custom Role

Only enterprise custom roles can be removed.

1. Click **Remove** next to the custom role.
2. Confirm the deletion in the dialog.
3. If required, type the confirmation text.
4. Click **Remove**.

Removing a role cannot be undone. Before deleting a role, make sure no workspace setup depends on it.

## Resource Permission Set Template

Resource permission set templates define reusable resource permission levels for new workspaces.

These templates do not decide who can access a resource. Instead, they define what a member can do after they are assigned a permission level on a specific resource.

To open the page, go to **Admin Console → Roles & Permissions → Resource Permission Set Template**.

The page contains two tabs:

| Tab                                | Purpose                                                 |
| ---------------------------------- | ------------------------------------------------------- |
| **App permission sets**            | Permission levels that can be used for apps.            |
| **Knowledge base permission sets** | Permission levels that can be used for knowledge bases. |

New workspaces inherit these permission set templates by default. Workspace administrators can later adjust permission sets inside their own workspace.

### Default App Permission Sets

| Permission Set      | Description                                                |
| ------------------- | ---------------------------------------------------------- |
| **Full Control**    | Full control of the app, including access settings.        |
| **Edit Content**    | Can edit app content and settings, but not access control. |
| **View Monitoring** | Can view app runs, logs, and monitoring data.              |
| **Preview App**     | Can only see the app in the list, without opening details. |

### Default Knowledge Base Permission Sets

| Permission Set             | Description                                                           |
| -------------------------- | --------------------------------------------------------------------- |
| **Full Control**           | Full control of the knowledge base, including access settings.        |
| **Edit Content**           | Can edit knowledge base content and settings, but not access control. |
| **Preview Knowledge Base** | Can only see the knowledge base in the list, without opening details. |

### Create a Permission Set

1. Open the **App permission sets** or **Knowledge base permission sets** tab.
2. Click **Create app permission set** or **Create knowledge base permission set**.
3. Enter a permission set name.
4. Add a description.
5. Select the resource permissions included in this permission set.
6. Click **Confirm**.

Permission sets are designed as reusable shortcuts. For example, an app permission set named **Edit Content** can include permissions such as editing app content and updating app configuration.

### Edit a Permission Set

1. Click the **...** menu next to a permission set.
2. Select **Edit**.
3. Update the name, description, or granted permissions.
4. Click **Confirm**.

Editing a permission set template affects how the template is inherited by new workspaces. It does not automatically rewrite permissions that have already been customized inside existing workspaces.

### Delete a Permission Set

1. Click the **...** menu next to a permission set.
2. Select **Delete**.
3. Confirm the deletion.

Deleting a permission set cannot be undone. If a permission set is required by your default workspace setup, avoid deleting it.

## Important Notes

* Admin console templates apply to new workspaces.
* Existing workspaces keep their current role and permission configurations unless they are manually updated.
* Workspace roles define what members can do at the workspace level.
* Resource permission sets define reusable permission levels for apps and knowledge bases.
* Resource access still needs to be configured on the specific resource when member-level access control is required.

## Recommended Setup Flow

1. Configure **Workspace Role Templates** first.
2. Configure **Resource Permission Set Template** for apps and knowledge bases.
3. Create a test workspace.
4. Verify that the new workspace inherits the expected roles and permission sets.
5. Assign members to roles and test resource access behavior.