docs: document configurable default member roles experiment - #26702
Closed
Emyrk wants to merge 2 commits into
Closed
docs: document configurable default member roles experiment#26702Emyrk wants to merge 2 commits into
Emyrk wants to merge 2 commits into
Conversation
Promotes the minimum-implicit-member experiment (Gateway Accounts) from the unsafe set into ExperimentsSafe so it is enabled via --experimental='*' and exposed through the AvailableExperiments API. This corresponds to the early access bar in docs/.style/content-guidelines.md, where docs follow safe experiments. Refs #25936 (PLAT-217).
Contributor
Docs preview📖 View docs preview for |
Emyrk
force-pushed
the
gateway-accounts/docs-default-member-roles
branch
6 times, most recently
from
June 25, 2026 15:07
6faaf82 to
ef918bd
Compare
Emyrk
marked this pull request as ready for review
June 25, 2026 15:58
Contributor
Documentation CheckUpdates Needed
What Looks Good
Automated review via Coder Agents |
Adds a Configurable default member roles section to the Organizations admin page covering what the setting does, how to enable the minimum-implicit-member experiment, how to PATCH the org via the API, and the limitations (built-in roles only, read-only in CLI and UI, deployment-wide RBAC impact). Cross-links from the Groups and Roles page near the implicit Member mention. Regenerates the Early Access table in feature-stages.md from the ExperimentsSafe entry, via scripts/release/docs_update_feature_stages.sh. Refs #25936.
Emyrk
force-pushed
the
gateway-accounts/docs-default-member-roles
branch
from
June 25, 2026 21:15
ef918bd to
e7ed607
Compare
Emyrk
added a commit
that referenced
this pull request
Aug 3, 2026
Frontend (Default Roles surface): - Correct the Default Roles copy: changes apply to existing members as well as new ones, and the internal term 'floor' is gone from all user-facing strings (CRF-11, CRF-12). - Show the Default Roles section read-only to viewers without editSettings; only the Edit button is permission-gated. Also disables Edit until the org roles query resolves (CRF-24, CRF-25, CRF-26). - Roles a member holds explicitly stay selectable in the member role dialog even when implied by org defaults, so overlapping explicit grants can be removed (CRF-13). - Rename stories named after the deleted prop (CRF-8). RBAC: - Restore prose explaining that organization-member grants no workspace access and define the floor/workspace-access split where it lives (CRF-14, CRF-27, CRF-5). - Unexport OrgWorkspaceAccessMemberPerms (CRF-18). - Rework the member-roles test to assert against the registered organization-workspace-access role instead of a witness derived from itself; use slices.ContainsFunc; drop the no-op reload pair (CRF-17, CRF-29, CRF-30, CRF-32, CRF-6). - coderd.go builds the full RoleOptions struct and compares to the zero value, so new fields cannot be silently ignored (CRF-20). Tests: - Remove the no-op ReloadBuiltinRoles(nil) pairs from the license usercount tests and parallelize them; rename the MinimumMember subtest; drop the orphaned bench comment (CRF-1, CRF-7, CRF-4). Docs: - Add a 'Default member roles' section to the organizations admin page and cross-link it from groups-roles, adapted for GA from the closed docs PR #26702 (CRF-3).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #26699 (
gateway-accounts/experiment-safe).Documents the
minimum-implicit-memberexperiment under the configurable per-orgdefault_org_member_rolessetting introduced by #25994. Adds the section to the existing Organizations admin page (rather than a standalone file) since it's an org-scoped knob, with a cross-link from Groups and Roles and the auto-generated Early Access entry infeature-stages.md.Changes
docs/admin/users/organizations.md: newConfigurable default member rolessection covering whatdefault_org_member_rolesdoes, how to enable the experiment, how toPATCHthe org via the API, and the limitations (built-in role names only, read-only in CLI and UI today, deployment-wide RBAC impact).docs/admin/users/groups-roles.md: short cross-link near the existing implicit Member sentence pointing to the new section.docs/install/releases/feature-stages.md: regenerated Early Access table viascripts/release/docs_update_feature_stages.sh(table-formatter normalized; only theminimum-implicit-memberrow is added).Verification
make lint/emdashclean.pnpm run lint-docsclean (0 errors).pnpm run format-docsno further changes after edits.docs/reference/api/organizations.md#update-organization,docs/admin/security/audit-logs.md, and the new heading#configurable-default-member-roles.["organization-workspace-access"]confirmed againstrbac.DefaultOrgMemberRoles()andmigrations/000516_org_default_member_roles.up.sql.403 Forbiddenbehavior confirmed againstenterprise/coderd/organizations.go(rejects non-default values without the experiment).coderd/rbac/roles.goorg role constants.Why a section, not a new page
Per
docs/.style/content-guidelines.md, safe experiments / Early Access features need at least one docs page covering enable/what/limits. The setting is org-scoped configuration that org admins reach through the Organizations page, so adding a section there avoids a tiny single-purpose file and keeps the configurable knob next to its parent concept. The Early Access callout flags the experiment dependency at the top of the section.Refs #25936 (PLAT-217).
Coder Agents on behalf of @Emyrk.