Skip to main content

​
Configure Permission Templates

Dify Enterprise provides admin-level RBAC templates to help organization administrators define the default permission structure for new workspaces. Admin console templates do not directly change permissions in existing workspaces. They define the initial roles and resource permission levels that will be inherited when a new workspace is created.

​
What You Can Configure

In the admin console, go to Roles & Permissions. You can configure two types of templates:

​
Workspace Role Templates

Workspace role templates define what members can do in a workspace. When a new workspace is created, it inherits the roles configured in this template. To open the page, go to Admin Console → Roles & Permissions → Workspace Role Templates. The page lists all default workspace roles, including:

​
System Preset Roles

System preset roles are built-in roles provided by Dify. They are used to keep permissions stable during upgrades and provide a reliable default role model for new workspaces. Common system preset roles include: System preset roles can’t be removed or edited.

​
Enterprise Custom Roles

Enterprise custom roles are roles created by enterprise administrators. They can be used to define permission models that match your organization’s internal responsibilities. You can:
  • Create a custom role.
  • Edit the role name, description, and permissions.
  • Remove the role if it is no longer needed.

​
Create a Role

  1. Click Create Role.
  2. Enter a role name.
  3. Add a role description.
  4. Select the permissions that should be granted to this role.
  5. Click Confirm.
Permissions are grouped by product area, such as Workspace and Application. You can search for permissions or expand each permission group to select individual permission points.

​
Edit a Role

  1. Click Detail for the role you want to edit.
  2. Review the role name, description, and selected permissions.
  3. Update the editable fields.
  4. Click Save.

​
Remove a Custom Role

Only enterprise custom roles can be removed.
  1. Click Remove next to the custom role.
  2. In the dialog, type the confirmation text and click Remove.
Removing a role cannot be undone. Before deleting a role, make sure no workspace setup depends on it.

​
Resource Permission Set Template

Resource permission set templates define reusable resource permission levels for new workspaces. These templates do not decide who can access a resource. Instead, they define what a member can do after they are assigned a permission level on a specific resource. To open the page, go to Admin Console → Roles & Permissions → Resource Permission Set Template. The page contains three tabs: New workspaces inherit these permission set templates by default. Workspace administrators can later adjust permission sets inside their own workspace.

​
Default App Permission Sets

​
Default Knowledge Base Permission Sets

​
Default Agent Permission Sets

​
Create a Permission Set

  1. Open the tab for the resource type, then click its create button, such as Create agent permission set.
  2. Enter a name and a description.
  3. Select the resource permissions to include. See Permission Reference for what each one allows.
  4. Click Confirm.
Permission sets are designed as reusable shortcuts. For example, an app permission set named Edit Content can include permissions such as editing app content and updating app configuration.

​
Edit a Permission Set

  1. Click the … menu next to a permission set.
  2. Select Edit.
  3. Update the name, description, or granted permissions.
  4. Click Confirm.
Editing a permission set template affects how the template is inherited by new workspaces. It does not automatically rewrite permissions that have already been customized inside existing workspaces.

​
Delete a Permission Set

  1. Click the … menu next to a permission set.
  2. Select Delete.
  3. Confirm the deletion.
Deleting a permission set cannot be undone. If a permission set is required by your default workspace setup, avoid deleting it.

​
Important Notes

  • Admin console templates apply to new workspaces.
  • Existing workspaces keep their current role and permission configurations unless they are manually updated.
  • Workspace roles define what members can do at the workspace level.
  • Resource permission sets define reusable permission levels for apps, knowledge bases, and agents.
  • Resource access still needs to be configured on the specific resource when member-level access control is required.
  1. Configure Workspace Role Templates first.
  2. Configure Resource Permission Set Template for apps, knowledge bases, and agents.
  3. Create a test workspace.
  4. Verify that the new workspace inherits the expected roles and permission sets.
  5. Assign members to roles and test resource access behavior.