> ## Documentation Index > Fetch the complete documentation index at: https://enterprise-docs.dify.ai/llms.txt > Use this file to discover all available pages before exploring further. # Permission Reference > What each permission lets a member do This page lists every permission and the actions it allows, so you can see exactly what you grant when you build a custom role or permission set. The App and Knowledge Base resource permissions below are also constrained by resource access. A member can use them only on the apps and knowledge bases their resource access reaches, even when their role grants the permission. See [Permissions](/en/3.11.x/use/workspace/roles-and-permissions#choose-who-can-reach-each-resource) for details. ## Workspace | Permission | What it lets a member do | | :---------------------------------------------------- | :------------------------------------------------------------------------------------------------------ | | **Manage members** | Invite members, assign and change their roles, and remove members. | | **Manage role permissions and resource access rules** | Create, edit, duplicate, and delete custom roles and permission sets, and manage resource access rules. | | **Manage customization** | Customize workspace branding, such as replacing the WebApp logo and removing Dify branding. | ## Applications | Permission | What it lets a member do | | :--------------------- | :----------------------------------------------------------------------------------- | | **Create apps** | Create apps from scratch, a template, or a DSL file, and duplicate existing apps. | | **Manage app tags** | Create, edit, and assign tags to apps. | | **Access App Library** | See the App Library in the main navigation, where published apps are listed to open. | ## App Resource Permissions | Permission | What it lets a member do | | :---------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- | | **Preview app** | See the app in the list, without opening its detail pages. | | **Read-only orchestration page** | Open the app's orchestration and configuration pages in read-only mode, and view its conversations, comments, variables, and annotations. | | **Test and use app** | Run and debug the app, including chat, completion, agent, and workflow test runs. | | **Edit and orchestrate app** | Edit the app's configuration and workflow, and manage its annotations, comments, and variables. | | **Import / export DSL** | Import and export the app's DSL, and publish it to the creators platform. | | **App publishing and version management** | Release the app and manage versions, the WebApp site, API access, and app API keys. | | **Access monitoring page** | View the app's monitoring page and usage statistics. | | **Configure external tracing** | View and change the app's external tracing configuration. | | **Access logs and annotations** | View the app's logs and annotations. | | **Configure app access permissions** | Set who can reach the app, through its resource access. | | **Delete app** | Delete the app. | ## Knowledge Bases | Permission | What it lets a member do | | :----------------------------------- | :------------------------------------------------------------------------------------- | | **Create knowledge bases** | Create knowledge bases, sync from sources like Notion, and import knowledge pipelines. | | **Manage knowledge base tags** | Create, edit, and assign tags to knowledge bases. | | **Connect external knowledge bases** | Connect an external knowledge base provider. | | **Manage knowledge base API keys** | Create and delete the knowledge base Service API keys. | ## Knowledge Base Resource Permissions | Permission | What it lets a member do | | :------------------------------------------------------- | :---------------------------------------------------------------------------------------- | | **Preview knowledge base** | See the knowledge base in the list, without opening its detail pages. | | **Read-only knowledge base** | Open the knowledge base in read-only mode and view its documents, segments, and settings. | | **Edit knowledge base** | Edit the knowledge base's settings, documents, segments, and metadata. | | **Add documents to knowledge base** | Add or upload documents to the knowledge base. | | **Delete knowledge base files** | Delete documents from the knowledge base. | | **Download documents** | Download documents from the knowledge base. | | **Knowledge base retrieval** | Run retrieval testing on the knowledge base. | | **Pipeline testing** | Test-run the knowledge pipeline. | | **Import / export knowledge pipeline DSL** | Import and export the knowledge pipeline DSL. | | **Knowledge pipeline publishing and version management** | Release the knowledge pipeline and manage its versions. | | **Configure knowledge base access permissions** | Set who can reach the knowledge base, through its resource access. | | **Delete knowledge base** | Delete the knowledge base. | ## Integrations ### Plugins | Permission | What it lets a member do | | :----------------------------- | :--------------------------------------------------------------------------- | | **Install and update plugins** | Install and update plugins from the Marketplace, GitHub, or a local package. | | **Delete plugins** | Uninstall plugins. | | **Debug plugins** | Get a debugging key and remotely debug plugins. | | **Configure models** | Add and configure model providers, models, and plugin endpoints. | | **Configure auto updates** | Set plugin auto-update preferences. | ### Tools and MCP | Permission | What it lets a member do | | :--------------- | :------------------------------------------------------------------- | | **Manage tools** | Create, edit, delete, and authorize custom, API, and workflow tools. | | **Manage MCP** | Create, edit, delete, and authorize MCP providers. | ### Credentials | Permission | What it lets a member do | | :------------------------------ | :--------------------------------------------------------------------------------------- | | **View and use credentials** | Use configured credentials and switch the active credential or preferred provider. | | **Add credentials** | Add a new credential, such as a model provider's API key or a data source authorization. | | **Edit and delete credentials** | Update and delete credentials, and manage OAuth and custom clients. | ### Data Sources and API Extensions | Permission | What it lets a member do | | :------------------------------------- | :------------------------------------------ | | **Manage data source configuration** | Configure the workspace's data sources. | | **Manage API extension configuration** | Add, edit, and delete API-based extensions. |