langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-20 19:50:06 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Add app-level permission control (Only me / All team members / Selected members) #21740

New Issue
Open
opened 2026-02-21 20:14:06 -05:00 by yindo · 1 comment
yindo commented 2026-02-21 20:14:06 -05:00
Owner
Copy Link
Copy Source

Originally created by @liqigang63 on GitHub (Jan 18, 2026).

Originally assigned to: @fatelei on GitHub.

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

In our team we create multiple AI apps within one Dify workspace. Currently every app is visible and editable by all team members once they have “workspace” access. This causes two problems:
Accidental edits: developers often open an app that is still under construction by another teammate and unknowingly change prompts or workflows.
Sensitive data leakage: some apps connect to internal APIs that return customer data. We only want the owner and a small group to see the logs or run the app.
Knowledge already supports “Only me / All members / Selected members” permission, so we have to put sensitive prompts into knowledge documents as a workaround, which is awkward.
Having the same three-level permission on the App object would solve the issue cleanly. Ideally the permission should control:
View (see the app in the app list)
Edit (open workflow/prompt canvas, save changes)
Run (call the published endpoint or use the “Preview” button)
A fallback “Inherit workspace default” could keep backward compatibility.

2. Additional context or comments

UI can reuse the same dropdown component in Settings → Knowledge → Permission.
API side could extend the apps table with a permission_mode column and a many-to-many table app_members for the “selected members” list.

3. Can you help us with this feature?

  • I am interested in contributing to this feature.
Originally created by @liqigang63 on GitHub (Jan 18, 2026). Originally assigned to: @fatelei on GitHub. ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] Please do not modify this template :) and fill in all the required fields. ### 1. Is this request related to a challenge you're experiencing? Tell me about your story. In our team we create multiple AI apps within one Dify workspace. Currently every app is visible and editable by all team members once they have “workspace” access. This causes two problems: Accidental edits: developers often open an app that is still under construction by another teammate and unknowingly change prompts or workflows. Sensitive data leakage: some apps connect to internal APIs that return customer data. We only want the owner and a small group to see the logs or run the app. Knowledge already supports “Only me / All members / Selected members” permission, so we have to put sensitive prompts into knowledge documents as a workaround, which is awkward. Having the same three-level permission on the App object would solve the issue cleanly. Ideally the permission should control: View (see the app in the app list) Edit (open workflow/prompt canvas, save changes) Run (call the published endpoint or use the “Preview” button) A fallback “Inherit workspace default” could keep backward compatibility. ### 2. Additional context or comments UI can reuse the same dropdown component in Settings → Knowledge → Permission. API side could extend the apps table with a permission_mode column and a many-to-many table app_members for the “selected members” list. ### 3. Can you help us with this feature? - [ ] I am interested in contributing to this feature.
yindo added the 💪 enhancementstale labels 2026-02-21 20:14:06 -05:00
yindo commented 2026-02-21 20:14:06 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Feb 19, 2026):

Hi, @liqigang63. I'm Dosu (https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested app-level permission controls for viewing, editing, and running apps to improve security in multi-app workspaces.
  • The proposal includes default inheritance from workspace permissions and updates to UI and API.
  • This feature aims to provide better usability than the current workaround using knowledge documents.
  • There has been no further activity or comments on this issue since it was opened.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of Dify by commenting here.
  • If I don’t hear back within 15 days, this issue will be automatically closed.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Feb 19, 2026): Hi, @liqigang63. I'm Dosu (https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested app-level permission controls for viewing, editing, and running apps to improve security in multi-app workspaces. - The proposal includes default inheritance from workspace permissions and updates to UI and API. - This feature aims to provide better usability than the current workaround using knowledge documents. - There has been no further activity or comments on this issue since it was opened. **Next Steps:** - Please let me know if this issue is still relevant to the latest version of Dify by commenting here. - If I don’t hear back within 15 days, this issue will be automatically closed. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label stale 💪 enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21740
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?