Add tri-state content permissions (Allow / Deny / Inherit) to fix role override issues #5327

New Issue

OVERLORD · 2026-02-05T09:58:00+03:00

OVERLORD commented

2026-02-05 09:58:00 +03:00

Originally created by @rozdun on GitHub (Jun 23, 2025).

Describe the feature you'd like

Add tri-state permissions at the content level: Allow, Deny, and Inherit. Right now, assigning a role to a book or shelf with limited permissions (e.g. just "View") cancels out global permissions from other roles the user might have, like "Edit" or "Delete". The system treats any content-level role assignment as a full override, even when it only specifies one permission. Tri-state would let us say: “this role can View here, but for everything else, fall back to the global role permissions.”

Describe the benefits this would bring to existing BookStack users

This would make permission behavior match how people expect roles to work. For example:

You have multiple team roles (e.g. Team X, Team Y) that give View access to different sets of books.
You have a Team Leader role with global Edit/Delete rights.

Right now, if you assign Team X to a book with just View, users with both roles can no longer edit, because the presence of Team X alone overrides Team Leader. This makes global roles useless unless they’re manually added to every item.

Tri-state permissions would fix this. You could give View to Team X while letting Team Leader keep its global rights. It simplifies permission management, avoids duplication, and better reflects real-world setups where team leaders need elevated access across many areas without micromanaging every shelf or page.

Can the goal of this request already be achieved via other means?

No. The only workaround is to manually reassign the global role at every content item, along with its permissions - defeating the purpose of having global roles and inheritance.

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

How long have you been using BookStack?

Under 3 months

Additional context

Tri-state permission logic ensures scoped overrides don’t accidentally block broader access. BookStack’s permission system is already robust, but this adjustment would resolve an unintuitive edge case and bring it closer to established access control standards.

Originally created by @rozdun on GitHub (Jun 23, 2025). ### Describe the feature you'd like Add tri-state permissions at the content level: **Allow,** **Deny,** and **Inherit.** Right now, assigning a role to a book or shelf with limited permissions (e.g. just "View") cancels out global permissions from other roles the user might have, like "Edit" or "Delete". The system treats any content-level role assignment as a full override, even when it only specifies one permission. Tri-state would let us say: “this role can View here, but for everything else, fall back to the global role permissions.” ### Describe the benefits this would bring to existing BookStack users This would make permission behavior match how people expect roles to work. For example: - You have multiple team roles (e.g. **Team X**, **Team Y**) that give _View_ access to different sets of books. - You have a **Team Leader** role with global _Edit/Delete_ rights. Right now, if you assign **Team X** to a book with just _View,_ users with both roles can no longer edit, because the presence of **Team X** alone overrides **Team Leader**. This makes global roles useless unless they’re manually added to every item. Tri-state permissions would fix this. You could give _View_ to **Team X** while letting **Team Leader** keep its global rights. It simplifies permission management, avoids duplication, and better reflects real-world setups where team leaders need elevated access across many areas without micromanaging every shelf or page. ### Can the goal of this request already be achieved via other means? No. The only workaround is to manually reassign the global role at every content item, along with its permissions - defeating the purpose of having global roles and inheritance. ### Have you searched for an existing open/closed issue? - [x] I have searched for existing issues and none cover my fundamental request ### How long have you been using BookStack? Under 3 months ### Additional context Tri-state permission logic ensures scoped overrides don’t accidentally block broader access. BookStack’s permission system is already robust, but this adjustment would resolve an unintuitive edge case and bring it closer to established access control standards.

OVERLORD added the 🔨 Feature Request label 2026-02-05 09:58:00 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5327