More control over space access in Confluence with new granular permissions

[#1]

I’m excited to announce that we’re introducing four new permissions for customers using Confluence roles to give admins and space owners more precise control over who can do what in a space. These changes have started to roll out, and should be available in your Confluence site over the next few days.

New permissions offer even more control

Based on your feedback, we’ve split some existing permissions into smaller, more focused capabilities. This gives you more flexibility when designing custom roles and managing access in sensitive spaces.

Important: These changes do not alter anyone’s current access.

• Anyone who previously had the “parent” permission will automatically have the new, split permissions. This applies to both default and custom roles, too.
• Anyone who did not have the parent permission will not gain any new access.
  
  

Parent permission (split from)	New permission
Manage everything in space	Manage all content in space
Manage everything in space	Create content templates
Manage everything in space	Manage look and feel of space
Comment on content	Delete own comments

With these new permissions, you can now, for example:

• Create roles that manage content or configuration of a space without giving the ability to “manage everything in the space”.
• Allow people to comment on content without also allowing them to delete their own comments (helpful in regulated or tightly controlled environments).

Clearer permission names

Alongside these new permissions, we’ve made small updates to several permission names to improve clarity and make it easier to understand exactly what each one controls. These are name changes only and do not change the underlying access.

Learn more about the new permissions and updated permission names.

What’s coming next

We’re continuing to invest in making roles and permissions more flexible and easier to manage at scale. Next up:

• Removing strict permission dependencies in custom roles so you can create configurations like:
  • “Admin without export”
  • “Manager without delete”
• New tooling to assign roles at scale, so you can move users to roles across your site without having to update permissions space by space.

Thank you for your support & early adoption of Confluence roles.

- The Confluence Permissions team

[David Skudra]

Awesome! 🔥🔥

[Marie Linda GOUDEAU]

Can we have a detailed description of the permission names, as the permissions in Jira?

[Marie Linda GOUDEAU]

Can a default role be disabled to prevent it from being assigned to a user?

[Lars Bollow]

Hi @Marie Casabonne

really good news. Could you please tell us what is the impact, if we "join the beta"?

• are the current permissions direcly affected?
  • will they be replaced in all spaces?
• can this action be undone?
• can this feature be tested on another instance/organization?
• something else?

Best

Lars

[Marie Casabonne]

@Marie Linda GOUDEAU 

• We're working on documentation update with detailed descriptions of all of the split permissions with roles.
• A default role can't be disabled. There is an open feature request for this if you'd like to vote for it.

 @Lars Bollow -

• If you join the roles beta, all permissions & access will technically remain the same, but because several permissions have been split, users may have more permissions (if they held the single permission before you enabled the beta, they will now hold all of the permissions that were split out from it when they're in the beta. All users will also have their access represented as Custom access until you assign them access using roles
  • Example: where a user before may have only had the View permission in a space, when roles is enabled, they will have View and Export individual content items, because of our split permissions
• If you want to opt out, you need to open a ticket with support. 
• Yes, if you have a sandbox or another instance for testing in your Atlassian organization, you can enable the roles beta there first, before enabling it in your production instance
• More on how to know if you're ready for roles in this doc!