docs/main/administration-guide/manage/admin/abac-channel-access-rules.mdx
Channel and Team Admins can self-manage access controls for their channels directly through the Channel Settings modal, without requiring System Admin intervention. For organization-wide policies created by System Admins, see System-wide attribute-based access policies. For team-scoped policies that apply rules across multiple channels within a team, see Team-level channel membership policies.
From Mattermost v11.8, channel access rules can be applied to both private and public channels. The two channel types behave differently under ABAC:
Each ABAC channel access policy has an explicit active state that determines whether the policy will automatically add users who meet the policy's criteria but are not yet channel members. For private channels, the policy's rules are always enforced to remove members who no longer meet the required attribute rules, regardless of the active state. For public channels, no member is ever removed by ABAC — the rules are advisory only.
With channel access rules, Channel and Team Admins can:
manage_channel_access_rules permission.You can also assign ABAC rules to a channel directly from a channel's details page in the System Console under Channel Management by enabling the Enable attribute-based channel access option. Under Access policy, select Link to a policy to select an existing policy.
</Tip>Channel access rules use the same simple interface as system policies, allowing you to create attribute-based conditions without complex syntax.
The Auto-add members based on access rules toggle controls automatic membership management. The behavior differs by channel type:
Private channels (hard gate): Membership stays consistently aligned with the rules, similar to how LDAP group channels work.
Public channels (advisory): ABAC never removes members — anyone can still join a public channel.
Auto-add/auto-sync is checked on a per-channel policy basis, not inherited from parent system-wide policies.
If a system policy has auto-sync enabled, Channel and Team Admins cannot disable it at the channel level.
If a system policy has auto-sync disabled, Channel and Team Admins can choose to enable it for their channel.
When no rules are configured, this toggle is automatically disabled.
On private channels, users who no longer meet required attribute rules are always removed during synchronization regardless of the auto-sync setting. On public channels, no member is ever removed by ABAC.
Before saving changes, Mattermost validates your rules to prevent common issues:
When you save changes that affect membership, a confirmation dialog shows you:
Once a policy is attached to a channel, the channel cannot be converted between public and private until the policy is removed. The two modes have different semantics (advisory vs. hard gate), so a silent conversion would change what an existing policy actually does to its members.
Membership policies behave differently depending on the type of channel they're applied to:
Public channels with membership policies may appear in Browse Channels under Recommended, and matching users may be marked Recommended in the channel invite flow. See Browse channels and Manage channel members for the end-user experience.
</Note>From Mattermost v11.8.0, channel admins can define channel-level permission rules for file upload and file download based on user attributes and channel role. Applicable roles include channel admin, channel member, and channel guest.
For system-wide permission policies that restrict file upload and download actions, see Permission policies.
From Mattermost v11.8.0, admins can use Simulate access in Channel Settings to preview whether selected users can perform actions such as uploading files or downloading files before saving policy changes.
Channel-level permission policies and Simulate access are gated by the PermissionPolicies feature flag (MM_FEATUREFLAGS_PERMISSIONPOLICIES) and require a Mattermost Enterprise Advanced license. See the Mattermost developer documentation for details on enabling feature flags in a self-hosted deployment. Mattermost Cloud customers can request this feature flag be enabled by contacting their Mattermost Account Manager or by creating a support ticket.
From Mattermost v11.7, Team Admins can create, edit, and delete channel membership policies directly from Team Settings, scoped to channels within their team. This lets teams self-manage attribute-based membership for their own channels without requiring a System Admin to create or modify a system-wide policy.
manage_team_access_rules permission.manage_team_access_rules permission when ABAC is enabled system-wide.The Membership Policies tab includes a sync status footer that shows:
Team-scoped sync is limited to the team admin's team scope. Triggering Sync now from Team Settings does not affect channels or policies outside the current team.
Sync behavior for team-scoped membership policies depends on the type of channel the policy is assigned to:
Mattermost automatically runs a sync job whenever a team-scoped membership policy is created, or its rules, assigned channels, or active state change. Team Admins don't need to manually trigger Sync now for these updates; the sync runs as part of the change.
Channel-level (child) ABAC policies now behave independently and consistently, even when parent system-wide policies exist. Each policy maintains its own active state and configuration.
When both system policies and channel rules are configured:
Ideal use cases for channel access rules:
Best practices:
When to use system policies vs. channel rules:
When channels have attribute-based access controls applied, users will see clear indicators and experience specific behaviors designed to maintain security while providing transparency.
Channel Members panel:
Add Members modal:
Browse Channels:
When ABAC is enabled for a private channel:
When ABAC is enabled for a public channel:
These behaviors apply across all Mattermost clients, including web, desktop, and mobile, to ensure consistent enforcement.
</Note>Common questions about attribute-based access control implementation and usage.
The Membership Policy tab is only visible when all of these conditions are met:
manage_channel_access_rules permission.No. Channel rules are always additive to system policies. Users must satisfy both system policies AND channel rules to access the channel. Channel and Team Admins cannot weaken or override restrictions set by System Admins.
For private channels, Mattermost prevents this with self-exclusion validation. If your rules would remove you from the channel, you'll see an error message and cannot save the changes until you adjust the rules or reset them.
For public channels, the self-exclusion check is skipped — public-channel ABAC is advisory, the policy can't kick anyone out, and you can always re-join a public channel directly. This lets you author a policy intended for a different team (for example, a Sales admin configuring an Engineering recommendation) without being blocked.
No. The two modes have different semantics — a public-channel policy is advisory while a private-channel policy is a hard gate that removes non-matching members. A silent conversion would change what the existing policy does to its members, so Mattermost requires you to remove the policy first, convert the channel, and re-attach the policy if you still want it.
No. Channel Settings only supports Basic Mode with simple attribute conditions. For complex expressions with nested logic or mixed operators, System Admins need to create policies in the System Console.
Delete all attribute conditions from the access rules table. When no rules are configured and no system policies are applied, the channel returns to standard access behavior.
The auto-sync toggle is automatically disabled when:
Troubleshooting auto-sync issues: If auto-sync functionality (automatic adding/re-adding of members) is not working as expected, verify that the channel's access control policy is in an active state. An inactive policy will prevent automatic member additions from occurring. Note that enforcement of rules (removal of members who no longer meet requirements) happens regardless of the policy's active state.
</Note>When you save access rules, membership sync job is created and changes are applied as soon as the job is completed. Additionally, Mattermost runs synchronization jobs every 30 minutes to handle attribute changes from external systems (LDAP, SAML).
Yes, users receive standard Mattermost notifications when they're removed from channels due to access rule changes, similar to manual removals.
Yes, the confirmation modal before saving shows exactly which users will be affected. System Admins can also view detailed synchronization logs in the System Console.
You can use any user attributes either synchronized via LDAP/SAML or manually configured by System Admins in System Console > System Attributes > User Attributes.
During the next synchronization (every 30 minutes), users who no longer match the access rules will be removed from the channel, and new users who now match will be added (if auto-sync is enabled).
No. Private channels with attribute-based access control cannot have guest users. This ensures strict adherence to access control policies based on organizational attributes.
No. Channels configured with group synchronization cannot use attribute-based access control. Group-sync and ABAC are mutually exclusive features - you must choose one method of access control per channel.