From 825a80fc793465f62cc5fec27a310f5416bf0fe1 Mon Sep 17 00:00:00 2001 From: Steven Masley Date: Thu, 25 Jun 2026 14:10:29 +0000 Subject: [PATCH 1/2] feat(codersdk): mark minimum-implicit-member experiment as safe Promotes the minimum-implicit-member experiment (Gateway Accounts) from the unsafe set into ExperimentsSafe so it is enabled via --experimental='*' and exposed through the AvailableExperiments API. This corresponds to the early access bar in docs/.style/content-guidelines.md, where docs follow safe experiments. Refs #25936 (PLAT-217). --- codersdk/deployment.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/codersdk/deployment.go b/codersdk/deployment.go index 8500dbac0cf..a0447cff9cd 100644 --- a/codersdk/deployment.go +++ b/codersdk/deployment.go @@ -5208,7 +5208,9 @@ var ExperimentsKnown = Experiments{ // users to opt-in to via --experimental='*'. // Experiments that are not ready for consumption by all users should // not be included here and will be essentially hidden. -var ExperimentsSafe = Experiments{} +var ExperimentsSafe = Experiments{ + ExperimentMinimumImplicitMember, +} // Experiments is a list of experiments. // Multiple experiments may be enabled at the same time. From e7ed6075cecb7a1b8ec80a5116d0f336bdb337d1 Mon Sep 17 00:00:00 2001 From: Steven Masley Date: Thu, 25 Jun 2026 14:47:45 +0000 Subject: [PATCH 2/2] docs: document configurable default member roles experiment Adds a Configurable default member roles section to the Organizations admin page covering what the setting does, how to enable the minimum-implicit-member experiment, how to PATCH the org via the API, and the limitations (built-in roles only, read-only in CLI and UI, deployment-wide RBAC impact). Cross-links from the Groups and Roles page near the implicit Member mention. Regenerates the Early Access table in feature-stages.md from the ExperimentsSafe entry, via scripts/release/docs_update_feature_stages.sh. Refs #25936. --- docs/admin/users/groups-roles.md | 6 +++++ docs/admin/users/organizations.md | 33 +++++++++++++++++++++++++ docs/install/releases/feature-stages.md | 4 ++- 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/docs/admin/users/groups-roles.md b/docs/admin/users/groups-roles.md index 84f3c898efb..409d9cce35f 100644 --- a/docs/admin/users/groups-roles.md +++ b/docs/admin/users/groups-roles.md @@ -31,6 +31,12 @@ Roles determine which actions users can take within the platform. A user may have one or more roles. All users have an implicit Member role that may use personal workspaces. +In Premium deployments, the implicit `organization-member` role can also be +trimmed per organization. See +[Configurable default member roles](./organizations.md#configurable-default-member-roles) +for how to remove workspace operations from the default member set under the +`minimum-implicit-member` experiment. + ## Custom Roles > [!NOTE] diff --git a/docs/admin/users/organizations.md b/docs/admin/users/organizations.md index b38c46cd485..f31364fcaaa 100644 --- a/docs/admin/users/organizations.md +++ b/docs/admin/users/organizations.md @@ -120,6 +120,39 @@ their organization. Users can be in multiple organizations. ![Workspace List](../../images/admin/users/organizations/workspace-list.png) +## Configurable default member roles + +> [!NOTE] +> Configurable default member roles are in +> [Early Access](../../install/releases/feature-stages.md#early-access-features), +> gated behind the `minimum-implicit-member` experiment. + +Each organization carries a `default_org_member_roles` list of built-in role +names. Coder unions this list into every member's effective roles at request +time, so changes propagate to all members on the next request without +re-issuing tokens or editing per-user role assignments. + +The default value is `["organization-workspace-access"]`. With that default, +every organization member can read, build, ssh into, and execute commands in +workspaces they own. Removing `organization-workspace-access` from the list, +or replacing it with another set of built-in roles, lets you create +organization members that don't have workspace operations by default. + +To edit `default_org_member_roles` in the dashboard, go to +**Admin settings** > **Organizations** > **Roles** > **Default Roles**. + +### Limitations + +- `default_org_member_roles` accepts built-in role names only: + `organization-admin`, `organization-auditor`, `organization-user-admin`, + `organization-template-admin`, `organization-workspace-creation-ban`, and + `organization-workspace-access`. Custom organization roles are rejected + today; assign them directly to members instead. +- Enabling the experiment changes how `organization-member` behaves + deployment-wide. Review [Groups and Roles](./groups-roles.md) and the + per-organization [audit log](../security/audit-logs.md) before enabling + on a deployment with existing custom RBAC. + ## Next steps - [Organizations - best practices](../../tutorials/best-practices/organizations.md) diff --git a/docs/install/releases/feature-stages.md b/docs/install/releases/feature-stages.md index 2ca91c29268..44c50cccae5 100644 --- a/docs/install/releases/feature-stages.md +++ b/docs/install/releases/feature-stages.md @@ -64,7 +64,9 @@ You can opt-out of a feature after you've enabled it. -Currently no experimental features are available. +| Feature | Description | +|---------------------------|-------------------------------------------------------------------------------------------------------------| +| `minimum-implicit-member` | Allows organizations to deviate from the default organization-member roles, in support of Gateway Accounts. | ## Beta