The App and Knowledge Base resource permissions below are also constrained by resource access. A member can use them only on the apps and knowledge bases their resource access reaches, even when their role grants the permission.See Permissions for details.
Workspace
| Permission | What it lets a member do |
|---|---|
| Manage members | Invite members, assign and change their roles, and remove members. |
| Manage role permissions and resource access rules | Create, edit, duplicate, and delete custom roles and permission sets, and manage resource access rules. |
| Manage customization | Customize workspace branding, such as replacing the WebApp logo and removing Dify branding. |
| Manage Agents | See Agents in the main navigation, and create, configure, and manage the workspace’s agents. |
Applications
| Permission | What it lets a member do |
|---|---|
| Create apps | Create apps from scratch, a template, or a DSL file, and duplicate existing apps. |
| Manage app tags | Create, edit, and assign tags to apps. |
| Access App Library | See the App Library in the main navigation, where published apps are listed to open. |
App Resource Permissions
| Permission | What it lets a member do |
|---|---|
| Preview app | See the app in the list, without opening its detail pages. |
| Read-only orchestration page | Open the app’s orchestration and configuration pages in read-only mode, and view its conversations, comments, variables, and annotations. |
| Test and use app | Run and debug the app, including chat, completion, agent, and workflow test runs. |
| Edit and orchestrate app | Edit the app’s configuration and workflow, and manage its annotations, comments, and variables. |
| Import / export DSL | Import and export the app’s DSL, and publish it to the creators platform. |
| App publishing and version management | Release the app and manage versions, the WebApp site, API access, and app API keys. |
| Access monitoring page | View the app’s monitoring page and usage statistics. |
| Configure external tracing | View and change the app’s external tracing configuration. |
| Access logs and annotations | View the app’s logs and annotations. |
| Configure app access permissions | Set who can reach the app, through its resource access. |
| Delete app | Delete the app. |
Knowledge Bases
| Permission | What it lets a member do |
|---|---|
| Create knowledge bases | Create knowledge bases, sync from sources like Notion, and import knowledge pipelines. |
| Manage knowledge base tags | Create, edit, and assign tags to knowledge bases. |
| Connect external knowledge bases | Connect an external knowledge base provider. |
| Manage knowledge base API keys | Create and delete the knowledge base Service API keys. |
Knowledge Base Resource Permissions
| Permission | What it lets a member do |
|---|---|
| Preview knowledge base | See the knowledge base in the list, without opening its detail pages. |
| Read-only knowledge base | Open the knowledge base in read-only mode and view its documents, segments, and settings. |
| Edit knowledge base | Edit the knowledge base’s settings, documents, segments, and metadata. |
| Add documents to knowledge base | Add or upload documents to the knowledge base. |
| Delete knowledge base files | Delete documents from the knowledge base. |
| Download documents | Download documents from the knowledge base. |
| Knowledge base retrieval | Run retrieval testing on the knowledge base. |
| Pipeline testing | Test-run the knowledge pipeline. |
| Import / export knowledge pipeline DSL | Import and export the knowledge pipeline DSL. |
| Knowledge pipeline publishing and version management | Release the knowledge pipeline and manage its versions. |
| Configure knowledge base access permissions | Set who can reach the knowledge base, through its resource access. |
| Delete knowledge base | Delete the knowledge base. |
Integrations
Plugins
| Permission | What it lets a member do |
|---|---|
| Install and update plugins | Install and update plugins from the Marketplace, GitHub, or a local package. |
| Delete plugins | Uninstall plugins. |
| Debug plugins | Get a debugging key and remotely debug plugins. |
| Configure models | Add and configure model providers, models, and plugin endpoints. |
| Configure auto updates | Set plugin auto-update preferences. |
Tools and MCP
| Permission | What it lets a member do |
|---|---|
| Manage tools | Create, edit, delete, and authorize custom, API, and workflow tools. |
| Manage MCP | Create, edit, delete, and authorize MCP providers. |
Credentials
| Permission | What it lets a member do |
|---|---|
| View and use credentials | Use configured credentials and switch the active credential or preferred provider. |
| Add credentials | Add a new credential, such as a model provider’s API key or a data source authorization. |
| Edit and delete credentials | Update and delete credentials, and manage OAuth and custom clients. |
Data Sources and API Extensions
| Permission | What it lets a member do |
|---|---|
| Manage data source configuration | Configure the workspace’s data sources. |
| Manage API extension configuration | Add, edit, and delete API-based extensions. |