coder · Emyrk · Jun 25, 2026 · Jun 25, 2026
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
@@ -5208,7 +5208,9 @@ var ExperimentsKnown = Experiments{
 // users to opt-in to via --experimental='*'.
 // Experiments that are not ready for consumption by all users should
 // not be included here and will be essentially hidden.
-var ExperimentsSafe = Experiments{}
+var ExperimentsSafe = Experiments{
+	ExperimentMinimumImplicitMember,
+}
 
 // Experiments is a list of experiments.
 // Multiple experiments may be enabled at the same time.

diff --git a/docs/admin/users/groups-roles.md b/docs/admin/users/groups-roles.md
@@ -31,6 +31,12 @@ Roles determine which actions users can take within the platform.
 A user may have one or more roles. All users have an implicit Member role that
 may use personal workspaces.
 
+In Premium deployments, the implicit `organization-member` role can also be
+trimmed per organization. See
+[Configurable default member roles](./organizations.md#configurable-default-member-roles)
+for how to remove workspace operations from the default member set under the
+`minimum-implicit-member` experiment.
+
 ## Custom Roles
 
 > [!NOTE]

diff --git a/docs/admin/users/organizations.md b/docs/admin/users/organizations.md
@@ -120,6 +120,39 @@ their organization. Users can be in multiple organizations.
 
 ![Workspace List](../../images/admin/users/organizations/workspace-list.png)
 
+## Configurable default member roles
+
+> [!NOTE]
+> Configurable default member roles are in
+> [Early Access](../../install/releases/feature-stages.md#early-access-features),
+> gated behind the `minimum-implicit-member` experiment.
+
+Each organization carries a `default_org_member_roles` list of built-in role
+names. Coder unions this list into every member's effective roles at request
+time, so changes propagate to all members on the next request without
+re-issuing tokens or editing per-user role assignments.
+
+The default value is `["organization-workspace-access"]`. With that default,
+every organization member can read, build, ssh into, and execute commands in
+workspaces they own. Removing `organization-workspace-access` from the list,
+or replacing it with another set of built-in roles, lets you create
+organization members that don't have workspace operations by default.
+
+To edit `default_org_member_roles` in the dashboard, go to
+**Admin settings** > **Organizations** > **Roles** > **Default Roles**.
+
+### Limitations
+
+- `default_org_member_roles` accepts built-in role names only:
+  `organization-admin`, `organization-auditor`, `organization-user-admin`,
+  `organization-template-admin`, `organization-workspace-creation-ban`, and
+  `organization-workspace-access`. Custom organization roles are rejected
+  today; assign them directly to members instead.
+- Enabling the experiment changes how `organization-member` behaves
+  deployment-wide. Review [Groups and Roles](./groups-roles.md) and the
+  per-organization [audit log](../security/audit-logs.md) before enabling
+  on a deployment with existing custom RBAC.
+
 ## Next steps
 
 - [Organizations - best practices](../../tutorials/best-practices/organizations.md)
diff --git a/docs/install/releases/feature-stages.md b/docs/install/releases/feature-stages.md
@@ -64,7 +64,9 @@ You can opt-out of a feature after you've enabled it.
 
 <!-- Code generated by scripts/release/docs_update_feature_stages.sh. DO NOT EDIT. -->
 <!-- BEGIN: available-experimental-features -->
-Currently no experimental features are available.
+| Feature                   | Description                                                                                                 |
+|---------------------------|-------------------------------------------------------------------------------------------------------------|
+| `minimum-implicit-member` | Allows organizations to deviate from the default organization-member roles, in support of Gateway Accounts. |
 <!-- END: available-experimental-features -->
 
 ## Beta