Workspaces access rights

​

Overview of workspaces access rights

FlowX 5.0 provides a structured role hierarchy designed to support multi-tenant workspace architecture while maintaining security and governance. The system includes predefined roles that cannot be modified, ensuring consistent access patterns across all FlowX deployments.

​

Authentication and authorization architecture

FlowX 5.0 separates authentication and authorization into distinct systems:

​

Role architecture

​

Organization level roles

​

Organization admin (org_admin)

​

Organization admin default permissions

The following table shows the specific permissions assigned to the organization admin role:

Resource	Read	Edit	Create	Delete	Admin	Comments
Organization Administration
Organization	⬜	✅	⬜	⬜	⬜	Organization settings management
Workspaces	✅	✅	✅	✅	✅	Complete workspace lifecycle control
Users	✅	✅	✅	✅	⬜	Organization user management
Groups	✅	✅	✅	✅	⬜	User group management
System Management
Out of office	✅	✅	✅	✅	⬜	Out of office policy management
Fonts	✅	✅	✅	✅	⬜	Global font resource management
Monitoring & Audit
Audit logs	✅	❌	❌	❌	⬜	Read-only access to system audit
Platform status	✅	❌	❌	❌	⬜	System health monitoring
Org Env Info	✅	✅	❌	❌	⬜	Environment information management
Org Audit log	✅	❌	❌	❌	⬜	Organization-specific audit access

​

Workspace level roles

​

Workspace admin (workspace_admin)

​

Workspace admin default permissions

The following table shows the specific permissions assigned to the workspace admin role:

Resource	Read	Edit	Create	Delete	Admin	Comments
Workspace Management
Workspace settings	✅	✅	⬜	⬜	⬜	Configure workspace parameters and policies
User & Group Management
Users	✅	✅	✅	✅	⬜	Add, remove, and manage workspace users
Groups	✅	✅	✅	✅	⬜	Create and manage user groups
Projects & Libraries
Projects	✅	✅	✅	✅	⬜	Full project lifecycle management
Libraries	✅	✅	✅	✅	⬜	Complete library management control
Dependencies	✅	✅	✅	✅	⬜	Manage project and library dependencies
Content & Branding
Themes	✅	✅	✅	✅	⬜	Theme creation and customization
Fonts	✅	✅	✅	✅	⬜	Font resource management
Media assets	✅	✅	✅	✅	⬜	Upload and organize media files
Runtime & Configuration
Runtime configurations	✅	✅	✅	✅	⬜	Manage runtime settings and parameters
Environment configs	✅	✅	✅	✅	⬜	Configure deployment environments
Integrations	✅	✅	✅	✅	⬜	Set up external system connections
Monitoring & Audit
Workspace audit logs	✅	❌	❌	❌	⬜	Read-only access to workspace audit
Usage analytics	✅	❌	❌	❌	⬜	View workspace usage statistics
Performance metrics	✅	❌	❌	❌	⬜	Monitor workspace performance

​

Workspace user (workspace_user)

​

Workspace user default permissions

The following table shows the specific permissions assigned to the workspace user role:

Resource	Read	Edit	Create	Delete	Admin	Comments
Workspace entities
Projects & libraries	❌	⬜	✅	⬜	❌	Can create new projects and libraries but cannot read all existing ones
Fonts	✅	❌	❌	❌	⬜	Read-only access to workspace fonts
Global media library	✅	❌	❌	❌	⬜	View workspace media assets
Themes (includes fonts)	✅	❌	❌	❌	⬜	Read-only access to workspace themes
Global audit logs	✅	⬜	⬜	⬜	⬜	Limited audit log visibility
Workspace access management
Workspace management	✅	❌	⬜	⬜	⬜	WORKSPACE_READ permission required for basic workspace visibility
Users	✅	❌	❌	❌	⬜	View workspace users but cannot manage
Groups	✅	❌	❌	❌	⬜	View workspace groups but cannot manage
[out of scope for 5.0] Out of office	✅	❌	❌	❌	⬜	Out of office management not available in 5.0
Platform status	✅	⬜	⬜	⬜	⬜	System status monitoring access
Environment information	✅	⬜	⬜	⬜	⬜	Environment configuration visibility
Runtime permissions
Builds	✅	⬜	❌	⬜	⬜	View build information for accessible projects
Active policy	✅	❌	⬜	⬜	⬜	Read-only access to active policies
Scheduled processes	✅	❌	⬜	❌	⬜	View scheduled process information
Configuration parameters overrides	✅	❌	❌	❌	⬜	Read-only access to configuration parameters
Process instances	✅	❌	⬜	⬜	⬜	View process instances for accessible projects
Task manager	✅	⬜	⬜	⬜	⬜	Task management visibility

​

Theme editor (theme_editor)

​

Theme editor default permissions

The following table shows the specific permissions assigned to the theme editor role:

Resource	Read	Edit	Create	Delete	Comments
Workspace entities
Projects & libraries	❌	⬜	❌	❌	Cannot create or manage projects/libraries - view only own work
Fonts	✅	✅	✅	✅	Full font management capabilities
Global media library	✅	✅	✅	✅	Complete media asset management
Themes	✅	✅	✅	✅	Full theme creation and customization
Global audit logs	✅	❌	⬜	⬜	Read-only audit log access
Workspace Access management
Workspace management	✅	❌	⬜	⬜	WORKSPACE_READ permission required for basic workspace access
Users	✅	❌	❌	❌	View workspace users but cannot manage
Groups	✅	❌	❌	❌	View workspace groups but cannot manage
Platform status	✅	⬜	⬜	⬜	System status monitoring access
Environment information	✅	⬜	⬜	⬜	Environment configuration visibility
Runtime permissions
Builds	✅	⬜	❌	⬜	View build information for accessible projects
Active policy	✅	❌	⬜	⬜	Read-only access to active policies
Scheduled processes	✅	❌	⬜	❌	View scheduled process information
Configuration parameters overrides	✅	❌	❌	❌	Read-only access to configuration parameters
Process instances	✅	❌	⬜	⬜	View process instances for accessible projects
Task manager	✅	⬜	⬜	⬜	Task management visibility

​

Workspace runtime editor (workspace_runtime_editor)

​

Workspace runtime editor default permissions

The following table shows the specific permissions assigned to the workspace runtime editor role:

Resource	Read	Edit	Create	Delete	Admin	Comments
Workspace entities
Projects & libraries	❌	⬜	✅	⬜	❌	Can create new projects and libraries, but can read only those to which they have been granted access
Fonts	✅	❌	❌	❌	⬜	Read-only access to workspace fonts
Global media library	✅	❌	❌	❌	⬜	View workspace media assets
Themes (includes fonts)	✅	❌	❌	❌	⬜	Read-only access to workspace themes
Global audit logs	✅	⬜	⬜	⬜	⬜	Limited audit log visibility
Workspace access management
Workspace management	✅	❌	⬜	⬜	⬜	WORKSPACE_READ permission required for basic workspace visibility
Users	✅	❌	❌	❌	⬜	View workspace users but cannot manage
Groups	✅	❌	❌	❌	⬜	View workspace groups but cannot manage
Platform status	✅	⬜	⬜	⬜	⬜	System status monitoring access
Environment information	✅	⬜	⬜	⬜	⬜	Environment configuration visibility
Runtime permissions
Builds	✅	⬜	✅	⬜	⬜	Can create builds and view build information
Active policy	✅	✅	⬜	⬜	⬜	Can edit active policies and runtime configurations
Scheduled processes	✅	✅	⬜	✅	⬜	Full management of scheduled processes
Configuration parameters overrides	✅	✅	✅	✅	⬜	Complete control over configuration parameter overrides
Process instances	✅	✅	⬜	⬜	⬜	Can view and edit process instances
Task manager	✅	⬜	⬜	⬜	⬜	Task management visibility

​

Project level roles

​

Project owner (project_owner)

​

Project owner default permissions

The following table shows the specific permissions assigned to the project owner role:

Resource	Read	Edit	Create	Delete	Admin/Owner	Comments
Projects & Libraries	✅	✅	⬜	✅	✅	Complete project ownership and governance control
Config permissions
Processes	✅	✅	✅	✅	⬜	Complete process definition and workflow management
Enumerations	✅	✅	✅	✅	⬜	Full enumeration management (also covers substitution tags functionality)
Media library & Document Intelligence	✅	✅	✅	✅	⬜	Complete media asset and document intelligence management
Notification templates	✅	✅	✅	✅	⬜	Full notification template configuration
Document templates	✅	✅	✅	✅	⬜	Complete document template management
Views	✅	✅	✅	✅	⬜	UI view configuration and management
Stages	✅	✅	✅	✅	⬜	Process stage definition and configuration
Allocation rules	✅	✅	✅	✅	⬜	Task and resource allocation rule management
Systems	✅	✅	✅	✅	⬜	External system integration configuration
Workflow	✅	✅	✅	✅	⬜	Workflow definition and management
Reusable UI	✅	✅	✅	✅	⬜	Complete UI component management with permission inheritance from project role
Reusable Functions	✅	✅	✅	✅	⬜	Full function component management with permission inheritance from project role
Dependencies	✅	✅	✅	✅	⬜	Project and library dependency management
Configuration parameters	✅	✅	✅	✅	⬜	Project configuration parameter management
AI agents	⬜	✅	⬜	⬜	⬜	AI agent configuration (read not available, edit only)
Runtime permissions
Builds	✅	⬜	✅	⬜	⬜	Can create and view builds
Active policy	✅	✅	⬜	⬜	⬜	Runtime policy management
Scheduled processes	✅	✅	⬜	✅	⬜	Scheduled process management
Configuration parameters overrides	✅	✅	✅	✅	⬜	Runtime configuration parameter override management
Process instances	✅	✅	⬜	⬜	⬜	Process instance monitoring and management
Task manager	✅	✅	✅	✅	⬜	Complete task management capabilities

​

Project editor (project_editor)

​

Project editor default permissions

The following table shows the specific permissions assigned to the project editor role:

Resource	Read	Edit	Create	Delete	Submit Version	Comments
Projects & Libraries	✅	✅	⬜	✅	⬜	Full project management except creation (handled at workspace level)
Config permissions
Processes	✅	✅	✅	✅	⬜	Complete process definition and workflow management
Enumerations	✅	✅	✅	✅	⬜	Full enumeration management (also covers substitution tags functionality)
Media library & Document Intelligence	✅	✅	✅	✅	⬜	Complete media asset and document intelligence management
Notification templates	✅	✅	✅	✅	⬜	Full notification template configuration
Document templates	✅	✅	✅	✅	⬜	Complete document template management
Views	✅	✅	✅	✅	⬜	UI view configuration and management
Stages	✅	✅	✅	✅	⬜	Process stage definition and configuration
Allocation rules	✅	✅	✅	✅	⬜	Task and resource allocation rule management
Systems	✅	✅	✅	✅	⬜	External system integration configuration
Workflow	✅	✅	✅	✅	⬜	Workflow definition and management
Reusable UI	✅	✅	✅	✅	⬜	Complete UI component management with permission inheritance from project role
Reusable Functions	✅	✅	✅	✅	⬜	Full function component management with permission inheritance from project role
Dependencies	✅	✅	✅	✅	⬜	Project and library dependency management
Configuration parameters	✅	✅	✅	✅	⬜	Project configuration parameter management
AI agents	⬜	✅	⬜	⬜	⬜	AI agent configuration (read not available, edit only)
Runtime permissions
Builds	✅	⬜	✅	⬜	⬜	Can create and view builds
Active policy	✅	✅	⬜	⬜	⬜	Runtime policy management
Scheduled processes	✅	✅	⬜	✅	⬜	Scheduled process management
Configuration parameters overrides	✅	✅	✅	✅	⬜	Runtime configuration parameter override management
Process instances	✅	✅	⬜	⬜	⬜	Process instance monitoring and management
Task manager	✅	✅	✅	✅	⬜	Complete task management capabilities

​

Project viewer (project_viewer)

​

Project viewer default permissions

The following table shows the specific permissions assigned to the project viewer role:

Resource	Read	Edit	Create	Delete	Comments
Projects & Libraries	✅	⬜	⬜	❌	Read-only access to project and library information
Config permissions
Processes	✅	❌	❌	❌	View process definitions and workflows
Project data model	✅	❌	❌	❌	Read-only access to project data structure
Enumerations	✅	❌	❌	❌	View enumeration values and data structures
Media library & Document Intelligence	✅	❌	❌	❌	View media assets and document intelligence configurations
Notification templates	✅	❌	❌	❌	View notification template configurations
Document templates	✅	❌	❌	❌	View document template configurations
Views	✅	❌	❌	❌	View UI configuration definitions
Stages	✅	❌	❌	❌	View process stage definitions
Allocation rules	✅	❌	❌	❌	View task and resource allocation rules
Systems	✅	❌	❌	❌	View system integrations and endpoints
Workflow	✅	❌	❌	❌	View workflow definitions and configurations
Reusable UI	✅	❌	❌	❌	Read-only UI component access with permission inheritance
Reusable Functions	✅	❌	❌	❌	Read-only function component access with permission inheritance
Dependencies	✅	❌	❌	❌	View project and library dependencies
Configuration parameters	✅	❌	❌	❌	View project configuration parameters
AI agents	⬜	❌	⬜	⬜	Limited AI agent visibility (read not available)
Runtime permissions
Builds	✅	⬜	❌	⬜	View build information and status
Active policy	✅	❌	⬜	⬜	View active runtime policies
Scheduled processes	✅	❌	⬜	❌	View scheduled process information
Configuration parameters overrides	✅	❌	❌	❌	View runtime configuration parameter overrides
Process instances	✅	❌	⬜	⬜	View process instance information and status
Task manager	✅	❌	❌	❌	View task management information

​

Special project features

​

Role management rules

​

Predefined role restrictions

​

Role visibility rules

​

Special permission features

​

Read-only view behavior

Key characteristics of read-only mode:

• All configuration elements are visible but not editable
• Export and audit functionalities remain available
• Usage overview and resource tracking accessible
• Copy operations to other projects/libraries permitted
• Can test processes, workflows

​

Administrative control

This inheritance model ensures:

• Consistent access patterns across all project resources
• Simplified permission management with single point of control
• Predictable behavior for users across different resource types
• Reduced administrative overhead for access control

​

Default groups

​

FlowX groups

​

Everyone in workspace group

​

Group naming convention

Group	UI Display Name	Technical Requirements
all_users_[workspace_name]	Everyone from <workspace name>	System-managed group representing all workspace members

​

Additional group features

​

Legacy role migration

​

FlowX 4.x to 5.0 role mapping

FlowX 4.x Role	FlowX 5.0 Equivalent	Notes
FLOWX_ADMIN	workspace_admin	Now workspace-scoped instead of global
FLOWX_CONFIGURATOR	workspace_user or project_editor	Depends on required access level
FLOWX_UI_DESIGNER	theme_editor	Enhanced with theme management capabilities
FLOWX_VIEWER	project_viewer	Now project-specific instead of global
Custom Keycloak roles	Manual review required	Assess against new role structure

​

Migration considerations

​

Access control for import/export operations

​

Project and library import behavior

Import Type	Required Permission	Access Assignment
Project Version (first import)	project_create in workspace	Importing user becomes project_owner
Project Version (existing)	project_create AND project_edit	Version added to existing project
Project Build (first import)	project_build_create	Creates project, user becomes project_owner
Project Build (existing)	project_build_create	Build added to existing project
Library Version	Same as project version	Same ownership rules apply
Library Build	project_build_create	Creates build only, no library config

​

Library build sharing

​

Comprehensive permission matrices

​

Combined permission matrix (summary view)

The following provides a high-level overview of key permissions across roles:

​

Organization-level permissions

Permission	org_admin
Workspaces
Create workspace	✅
Edit workspace settings	✅
Delete workspace	✅
View all workspaces	✅
Organization Users
Add users to organization	✅
Remove users from organization	✅
Assign organization roles	✅
View all user access	✅
Global Settings
Configure organization settings	✅
Manage global policies	✅
Access system configurations	✅

​

Workspace-level permissions

Permission	workspace_admin	workspace_user	theme_editor	runtime_editor
Projects
Create project	✅	✅	✅	✅
View projects	✅	✅	✅	✅
Delete any project	✅	❌	❌	❌
Libraries
Create library	✅	✅	✅	✅
View libraries	✅	✅	✅	✅
Delete any library	✅	❌	❌	❌
Themes & Branding
Create themes	✅	❌	✅	❌
Edit themes	✅	❌	✅	❌
Delete themes	✅	❌	✅	❌
Manage fonts	✅	❌	✅	❌
Runtime Management
Runtime configurations	✅	❌	❌	✅
Runtime deployments	✅	❌	❌	✅
User Management
Add workspace users	✅	❌	❌	❌
Remove workspace users	✅	❌	❌	❌
Assign workspace roles	✅	❌	❌	❌
Create user groups	✅	❌	❌	❌
Workspace Settings
Configure workspace	✅	❌	❌	❌
Manage workspace policies	✅	❌	❌	❌
View audit logs	✅	❌	❌	❌

​

Project-level permissions

Permission	project_owner	project_editor	project_viewer
Process Design
Create processes	✅	✅	❌
Edit processes	✅	✅	❌
Delete processes	✅	✅	❌
View processes	✅	✅	✅
Configuration
Manage enumerations	✅	✅	❌
Configure templates	✅	✅	❌
Set up integrations	✅	✅	❌
Manage parameters	✅	✅	❌
Runtime Management
Create builds	✅	✅	❌
Deploy to runtime	✅	✅	❌
Manage active policies	✅	✅	❌
View runtime status	✅	✅	✅
Access Control
Grant project access	✅	❌	❌
Modify project permissions	✅	❌	❌
Remove project access	✅	❌	❌
Project Administration
Delete project	✅	❌	❌
Archive project	✅	❌	❌
Export project	✅	✅	❌

​

Predefined FlowX roles

The following table provides comprehensive information about all predefined roles in FlowX 5.0:

Role	Name	Description	Type	Key Characteristics
org_admin	Organization admin	Complete administrative access to manage users, workspaces, groups, roles, and system settings across the organization.	Organization	• Cannot be edited, duplicated, deleted • Only assignable in Organization admin space • Hidden from workspace role lists
workspace_admin	Workspace admin	Manages workspace-level resources including users, roles, themes. Cannot manage organization-wide settings.	Workspace	• Cannot be edited, duplicated, deleted • Listed in workspace role lists • Can be assigned to users/groups
workspace_user	Workspace user	Standard workspace access with project creation capabilities. Ideal for configurators building projects.	Workspace	• Cannot be edited, deleted • Can be duplicated for customization • Default role for workspace members
theme_editor	Theme editor	Extended workspace user with theme, font, and media asset management capabilities.	Workspace	• Same base characteristics as workspace_user • Additional visual asset management permissions
workspace_runtime_editor	Runtime editor	Extended workspace user with runtime configuration and deployment management capabilities.	Workspace	• Same base characteristics as workspace_user • Additional runtime management permissions
project_owner	Project owner	Complete project ownership with governance rights. Automatically assigned to project creators.	Project	• System-managed role, cannot be edited/deleted • Hidden from role selection interfaces • Permanent assignment, cannot be transferred
project_editor	Project editor	Full access to manage project resources, processes, workflows, and runtime settings.	Project	• Can be duplicated for customization • Standard role for project team members • Comprehensive access without ownership rights
project_viewer	Project viewer	Read-only access to project configuration and runtime settings for audit and review purposes.	Project	• Safe role for stakeholders needing visibility • No modification capabilities • Suitable for compliance and monitoring

​

Role permission summary

​

Best practices

​

Role assignment strategies

​

Common role assignment patterns

​

Current limitations in FlowX 5.0

Role Management:

• Custom roles not available (planned for future versions)
• Role transfer/ownership transfer not available (planned for 5.1)
• Bulk role assignment tools not available

Workspace Features:

• Workspace deletion functionality not available
• Moving projects/libraries between workspaces not supported
• Workspace-level audit logs for user management not implemented (planned for 5.1)

Integration Features:

• Out of office management (planned for 5.1 at organization level)
• Runtime roles and groups will return errors if Keycloak is not the authentication provider

Migration Features:

• Cache clearing required after lib2lib migration for proper functionality
• Inactive process instances require separate migration script if needed

​

Troubleshooting

​

Common role assignment issues