docs/main/administration-guide/onboard/advanced-permissions.mdx
Mattermost system admins using Mattermost Cloud or Mattermost Server can use Advanced Permissions to customize which users can perform specific actions, such as creating teams, managing channels, and configuring webhooks. The Mattermost permission system is based on a modified RBAC (role-based access control) architecture, using roles to determine which users have the ability to perform various actions.
Two permission schemes are provided in Mattermost:
This document describes the types of permissions that can be given to users of Mattermost using schemes as well as channel settings and roles. The permissions backend documentation provides additional technical details around permissions.
The Mattermost System Console provides a number of elements for Admins to control the permissions in their system.
You can set the default permissions granted to system admins, team admins, channel admins, guests (if enabled), and all members. The permissions granted in the System Scheme apply system-wide, meaning:
To override the System Scheme default permissions in a specific team, you must set up a Team Override Scheme.
You can access the System Scheme interface by going to System Console > User Management > Permissions > System Scheme.
On systems with multiple Mattermost teams, each team may operate and collaborate in a unique way. Team Override Schemes give Admins the flexibility to tailor permissions to the needs of each team.
When you use this permission scheme:
You can access the Team Override Scheme interface by going to System Console > User Management > Permissions > Team Override Schemes.
The channel permissions interface is accessed in System Console > User Management > Channels.
See the team and channel management documentation for details on available channel access controls.
This section provides some examples of common permissions use cases for team management, channel management, and overall permissions.
Example: A classified organization wants to use Mattermost teams for classified projects. In each project, team members can't know about members outside of their project, and @mentions can't disclose the names of people outside of a classified project.
Use the mmctl permissions remove command to revoke the view_member permission from the system_user role: mmctl permissions remove system_user view_member.
Example: In Team A, only allow system and team admins to add new team members. As the default for all other teams, allow all users to add and invite new members.
- Name and describe the scheme. For example,
Authorized Personnel Onlywith descriptionRestrict adding team members to eam and System Admins.- Select Add Teams to add Team B to the Select teams to override permissions list, locate Team B, then select Add.
- In the All Members panel, uncheck the box for Add Team Members.
- In the Team Administrators panel, check the box for Add Team Members.
Example: As the default for the entire system, restrict renaming channels and editing headers and purposes to admins only.
The Manage Channel Settings option is now only available to channel admins, team admins, and system admins.
Example: In Team C, restrict public channel creation to admins. As the default for all other teams, allow everyone to create public channels.
- Name and describe the scheme. For example,
Contractor Schemewith descriptionRestrict public channel creation to Admins only.- Select Add Teams to add Team B to the Select teams to override permissions list, locate Team B, then select Add.
- In the All Members panel, in the Manage Public Channels section, uncheck the box for Create Channels.
- In the Team Administrators panel, in the Manage Public Channels section, check the box for Create Channels.
Example: Set the default setting to allow all members, team admins, and channel admins to convert public channels to private.
This permission is applied to all other roles (excluding the Guest role). When this permission is not enabled for all members, it must be manually applied to team admins and channel admins if required.
The channel is available for all members and guests to access, but guests can only read messages and react to them.
The channel is available for all members and guests to access but only admins can post.
Example: As the default for the entire system, restrict deleting posts to only system and team admins.
Example: As the default for the entire system, only allow users to edit their own posts for five minutes after posting.
300 seconds.From Mattermost v11.8, system admins can use the Edit Attachments permission to control whether users can add or remove file attachments when editing posts.
The Edit Attachments permission is separate from Edit Own Posts. Users with permission to edit a post can still update the post text, but they can't add or remove file attachments unless Edit Attachments is also enabled.
By default, Edit Attachments is granted to users who have permission to edit posts.
To allow users to edit post text without changing attachments:
If a user sees Post attachments cannot be edited when editing a post, they don't have permission to add or remove attachments for that post.
From Mattermost v11.2, the System Console provides enhanced controls for managing integrations (webhooks, slash commands, OAuth apps), including separate permissions for managing your own integrations versus other users' integrations.
Example: As the default for the entire system, only allow system admins to create, edit and delete integrations.
There are a number of API and mmctl tools available for admins to help in configuring and troubleshooting the permissions system:
Technical admins or developers looking for a deeper understanding of the permissions backend can refer to our permissions backend documentation.