---
title: "All-new Role-Based Access Control Engine, Custom Roles and more | Phase Changelog"
description: "Access control across the Phase platform has been reworked from the ground up to be more granular and completely customizable."
url: https://phase.dev/changelog/updated-rbac/
---

[Changelog](https://phase.dev/changelog/)

2024.11.12

# All-new Role-Based Access Control Engine, Custom Roles and more

Access control across the Phase platform has been reworked from the ground up to be more granular and completely customizable.

[console](https://phase.dev/changelog/tag/console/)[cli](https://phase.dev/changelog/tag/cli/)[rbac](https://phase.dev/changelog/tag/rbac/)

Access control across the Phase platform has been reworked from the ground up to be more granular and completely customizable. We've added a whole new modular permissions framework, with 3 managed roles and full support for custom roles.

* * *

## All-new access control framework

Until now, users on Phase could only be assigned one of 3 roles: Owner, Admin or Developer. These were hardcoded roles created to accommodate a basic permission model. These roles had implicit rules about what actions were allowed or not, and while this system worked for very basic use-cases, it lacked the sophistication and flexibility that larger teams and enterprises required.

To address this, we've completely reworked the access control and permission model across the Phase platform. As part of this update, we've formalized the 3 managed roles, as well as added support for custom roles with arbitrary permission policies for any use case.

## Permission framework

The new permission framework is a modular system that allows you to define and manage granular permissions across a range of resources. We've divided resources into two categories: *Organisation resources* and *App resources*. As the names imply, these two categories of resources allow you to define a permission policy for each role based on the resources that can be managed at the Organisation and App level respectively.

### Organization-level permissions:

| Resource | Description |
| --- | --- |
| **Organisation** | Manage overall access to the organization |
| **Billing** | Control access to billing & payment information in settings |
| **Apps** | Manage access to applications within the organization |
| **Members** | Control user membership and access within the organization |
| **Service Accounts** | Manage service account permissions |
| **Roles** | Define and assign roles within the organization |
| **Integration Credentials** | Manage credentials for third-party integrations |

### App-level permissions:

| Resource | Description |
| --- | --- |
| **Environments** | Control access to different secret environments within the app |
| **Secrets** | Manage access to app secrets |
| **Lockbox** | Control access to Lockbox secret sharing |
| **Logs** | Manage access to app and secret audit logs |
| **Tokens** | Control creation and management of access tokens |
| **Members** | Manage user access within the app |
| **Integrations** | Control setup and management of app integrations |
| **Encryption Mode** | Manage encryption settings for the app |

For each of the resources above, you can define a set of allowed CRUD (Create, Read, Update, Delete) actions that are available to a specific role. These permissions are then used by the permission engine when evaluating access requests, API calls, or various other operations.

## Managed roles

The Owner, Admin and Developer roles have been formalized using this new permission model. You can check out the specific rules enforced by each of these roles by navigating to the Roles tab in the new Access page from the sidebar:

![roles list](https://phase.dev/assets/images/changelog/rbac/managed-roles-list.png)

You can click "View" on any managed role to view the details of the permissions policy:

![developer managed role](https://phase.dev/assets/images/changelog/rbac/developer-role-detail.png)

Check out the [docs](https://docs.phase.dev/access-control/roles#managed-roles) for a full list of managed roles and their associated permissions policies. As we continue to extend the feature set of Phase, we will extend these managed roles with sensible defaults, and may add additional managed roles as well.

## Custom roles

One of the primary goals of the new access and permissions system is to allow users to create their own custom roles with permission policies that are tailored to their needs. Custom roles can be created by clicking the "Create role" button and setting a permission policy for each resource:

![custom role](https://phase.dev/assets/images/changelog/rbac/custom-role.png)

You can either select an access level from one of:

-   No access
-   Read access
-   Full access

or set a custom access level based on your needs. We don't enforce any restrictions on the permissions that you define for a role, so feel free to experiment with different combinations and see what works best for you!

However, bear in mind that certain combinations of permissions are required to perform certain actions. We've put together a helpful [cheat sheet](https://docs.phase.dev/access-control/roles#resource-permissions-cheat-sheet) to help you make sure you've set up the correct permission combinations for certain common use-cases.

## UI Navigation updates

As part of this release, we've also updated the UI to consolidate access related resources into a new "Access" page, accessible from the sidebar. The "Access" page contains tabs to manage organisation *Members* and *Roles*. The *Authentication* tab lets you view and manage personal access tokens (PATs).

* * *

The all new access and permission engine is live on Phase Cloud and available with version [v2.32.0](https://github.com/phasehq/console/releases/tag/v2.32.0) for self-hosted users.

Reach out on [Slack](https://slack.phase.dev) or [GitHub](https://github.com/phasehq) for any questions or feedback on this release!

RoadmapCommunity-driven

Request a feature

We build features based on community requests and feedback. Looking for a specific feature or have a use-case in mind? Reach out to us.

[Feature request](https://github.com/phasehq/console/issues/new?template=feature_request.md)

DeploymentSelf-hosted / Cloud

Get started

## Keep your secrets

Self-host or start on fully managed Cloud in under a minute.

Self-hosted

Run Phase on your own infrastructure. Free and open source.

AI agent deployment skill

[![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi)

[Self-hosting guide](https://docs.phase.dev/self-hosting)

Cloud

Fully managed. From signup to your first secret in 60 seconds.

Sign up with

[Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)