Skip to content

docs(rbac): consolidated RBAC fixes and transition guide#606

Draft
jordanc-relevanceai wants to merge 1 commit into
mainfrom
docs-merge/rbac
Draft

docs(rbac): consolidated RBAC fixes and transition guide#606
jordanc-relevanceai wants to merge 1 commit into
mainfrom
docs-merge/rbac

Conversation

@jordanc-relevanceai
Copy link
Copy Markdown
Collaborator

@jordanc-relevanceai jordanc-relevanceai commented May 5, 2026

This PR consolidates 2 drafter PRs that all modify the RBAC docs. Each section below is the original description from a source PR. Opening as draft for review before closing the source PRs.

Source PRs (kept open until confirmed)

Files touched

  • admin/project-management/add-members.mdx — adds Chat role accordion, simplifies the Viewer description, and reframes the existing Info banner so it links to both the RBAC docs and the transition guide
  • enterprise/rbac.mdx — adds clarifying callouts (Editor scoping, Viewer access, asset visibility), plus three new H2 sections: "Transitioning to RBAC", "Permission inheritance and cascading", and "Technical implementation notes"

Reconciliation note

Both PRs edit the same two files. #586 frames the legacy page as describing only Admin/Editor/Viewer; #583 adds Chat to that same page. Reconciled the framing in one pass so the docs don't ship two contradicting messages.


#583 — docs(TSP-1150): fix critical RBAC permission inaccuracies

Summary

  • Fixes incorrect Viewer permissions in add-members.mdx: removes the false "Can run agents" claim from the Viewer role
  • Adds missing Chat role to add-members.mdx (was entirely absent from the page)
  • Updates Viewer description to align with enterprise/rbac.mdx: view-only, cannot run or edit
  • Adds link from add-members.mdx to the full RBAC reference page

In enterprise/rbac.mdx:

  • Editor clarification: Editor is project-level only; Project Editors auto-get Admin on all project assets
  • Viewer clarifications (both project-level and asset-level): no field-level redaction — Viewers see full configs or nothing, not partial metadata
  • New section: "Permission inheritance and cascading": documents how project roles cascade to assets, and that Members require explicit asset-level grants
  • New section: "Technical implementation notes": covers Member/operator naming, OpenFGA usage, and legacy system behavior for embedded agents

Context

Customer confusion traced to two root causes:

  1. The add-members.mdx Viewer role incorrectly stated Viewers can run agents (they cannot — can_trigger requires operator/Member minimum)
  2. Permission cascading behavior was completely undocumented, causing confusion when project-level Viewer access didn't cascade as expected to "invited users only" agents

Fixes: https://linear.app/relevance/issue/TSP-1150/

Test plan

  • Verify add-members.mdx Viewer accordion no longer mentions running agents
  • Verify Chat role accordion is present in add-members.mdx
  • Verify Info callout links correctly to /enterprise/rbac
  • Verify new sections render correctly in Mintlify preview
  • Verify Warning callout in permission inheritance section is a single paragraph (CLAUDE.md compliant)
  • Verify all headings are in sentence case

#586 — docs(TSP-1152): add RBAC transition guide and legacy permissions note

Summary

  • Added a new Transitioning to RBAC section to enterprise/rbac.mdx covering:
    • What the legacy permission system looked like (3 roles, no asset-level granularity)
    • How legacy roles map to RBAC roles by default during migration
    • Critical warning about the Viewer role behavior change (legacy Viewers could run agents; RBAC Viewers cannot)
    • What changes after RBAC is enabled (asset-level enforcement, 403 errors without explicit grants, per-tool credential scoping)
    • Admin action items checklist for post-migration access review
  • Added a legacy permissions callout to admin/project-management/add-members.mdx directing RBAC-enabled orgs to the RBAC docs

Test plan

  • Verify the Transitioning to RBAC section renders correctly in Mintlify preview
  • Verify the Info callout on add-members.mdx renders and the link to /enterprise/rbac resolves
  • Check all internal links (/get-started/chat/introduction, /enterprise/rbac) are valid
  • Confirm sentence case on all headings

Linear: https://linear.app/relevance/issue/TSP-1152/


Linear



Combines two drafter PRs that both modify add-members.mdx and
enterprise/rbac.mdx:

- TSP-1150 (#583): correct inaccuracies — adds Chat role to add-members,
  simplifies Viewer accordion, adds clarifying callouts about Editor
  scoping, Viewer access scope, and asset-level visibility, and adds
  "Permission inheritance and cascading" + "Technical implementation
  notes" sections
- TSP-1152 (#586): adds the "Transitioning to RBAC" section covering
  what changes during migration, role mapping, and admin action items

Reconciled the Info banner at the top of add-members.mdx so both PRs'
framing co-exists: the page now describes itself as the standard
permission system for orgs not yet migrated to RBAC, with links to
both the RBAC docs and the transition guide.
@mintlify
Copy link
Copy Markdown
Contributor

mintlify Bot commented May 5, 2026

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated (UTC)
relevanceai 🟢 Ready View Preview May 5, 2026, 4:44 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

@linear
Copy link
Copy Markdown

linear Bot commented May 5, 2026

@jordanc-relevanceai jordanc-relevanceai changed the title docs(rbac): consolidate RBAC fixes and transition guide docs(rbac): consolidated RBAC fixes and transition guide May 5, 2026
@jordanc-relevanceai jordanc-relevanceai self-assigned this May 5, 2026

<Info>
This page covers adding members to projects and organizations. If you're on an Enterprise subscription and want to learn about Role-Based Access Controls (RBAC) with more granular permissions, see our [RBAC documentation](https://relevanceai.com/docs/enterprise/rbac).
This page describes the standard permission system used by organizations that have not yet migrated to RBAC. If your organization has RBAC enabled, see [Role-based access controls (RBAC)](/enterprise/rbac) for the current permission model and the [transition guide](/enterprise/rbac#transitioning-to-rbac) for what changes during migration.
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't change this line - leave it as is.

### User roles

Members in your organization can be assigned the following roles: Admin, Editor and Viewer. These roles determine what they can do inside of the platform, and what they can do when using the API.
Members in your organization can be assigned the following roles: Admin, Editor, Chat, and Viewer. These roles determine what they can do inside of the platform, and what they can do when using the API.
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

leave this as it was - Chat is not a general role type

</Accordion>
<Accordion title="Chat" icon="message" iconType="duotone">
Access [Relevance Chat](/get-started/chat/introduction) only — cannot access the web app. Requires asset-level permissions to run specific agents.
</Accordion>
Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

REMOVE

**Other permissions:**

- Can run agents.
View agents, tools, and knowledge outputs only. Cannot run agents, create assets, or edit anything.
Copy link
Copy Markdown
Collaborator Author

@jordanc-relevanceai jordanc-relevanceai May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fact check this against the codebase - is this a real change?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs-drafter Documentation drafted by Claude

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant