Role-Based Access Control (RBAC)

M3 Forge uses role-based access control to manage what each user can do across your workspace. Every user is assigned a single role, and that role determines the set of permissions they have.

Available Roles

M3 Forge provides six predefined system roles. System roles cannot be modified or deleted.

Administrator

Full system access. Administrators have a wildcard permission (*) that grants every operation on every resource. Use this role for workspace owners and platform operators.

Capabilities:

• All permissions across every resource
• User management (invite, remove, change roles, impersonate)
• System settings configuration
• API key and credential management
• Role creation and management

Editor

The primary role for active contributors who build and iterate on workflows, DAGs, and related resources.

Capabilities:

• Create, edit, delete, and execute workflows
• Manage DAGs and query plans
• Create and manage credentials (except delete)
• Read gateways and test connectivity
• Create and manage API keys
• Create and update RAG indexes
• Read annotator configs, deployments, storage, events, and roles

Member

Read-only access to the workspace. Members can view all resources but cannot create, modify, or execute anything. This is the default role assigned to new users.

Capabilities:

• View workflows, DAGs, jobs, and query plans
• View deployments, gateways, events, and storage
• View annotator configs and RAG indexes
• View roles
• List credentials (without reading values)

Workflow Editor

Focused role for users who manage workflows and DAGs without access to credentials or system settings.

Capabilities:

• Full workflow management (create, edit, delete, execute, activate, deactivate)
• Full DAG management
• Full query plan management (create, edit, delete, execute)
• View and manage jobs (read, cancel, retry)
• Read gateways and test connectivity
• Read events, storage, and roles

Deployment Editor

Manages deployments and gateway infrastructure without access to workflows or credentials.

Capabilities:

• Full deployment management (create, edit, delete)
• Full gateway management (create, edit, delete, test)
• Read workflows and jobs
• Read roles

Document Editor

Manages knowledge base resources including RAG indexes, storage, and annotator configurations.

Capabilities:

• Full RAG index management (create, edit, delete)
• Full annotator config management (create, edit, delete)
• Read and update storage
• Read workflows and roles

Permissions Matrix

Detailed breakdown of permissions by role. Admin has all permissions via wildcard and is omitted for brevity.

Workflows

Jobs

DAGs

Query Plans

Deployments

Gateways

RAG Indexes

Storage

Annotator Configs

Credentials

API Keys

Events

Roles

Managing User Roles

Administrators can update any user’s role from the Members settings page.

Default Role

New users are assigned the Member role by default. Self-hosted deployments can override this with the DEFAULT_USER_ROLE environment variable:

# Set default role for new users (defaults to global:admin for self-hosted)
DEFAULT_USER_ROLE=global:member

Valid values: global:admin, global:editor, global:member, global:workflow-editor, global:deployment-editor, global:document-editor.

Custom Roles

For access patterns that don’t fit the built-in roles, administrators can create custom roles with specific permission combinations.

SSO Role Mapping

When users authenticate via SSO, their provider-assigned roles are mapped to M3 Forge roles:

Best Practices

Principle of Least Privilege

Assign users the minimum role required for their responsibilities:

1. Start new users with Member (read-only)
2. Promote to a specialized editor role (Workflow, Deployment, or Document) based on their function
3. Grant Editor for broad contributor access
4. Reserve Administrator for platform operators

Specialized Roles for Separation of Duties

Use the specialized editor roles to enforce boundaries:

• Workflow Editor for pipeline developers who don’t need credential access
• Deployment Editor for release engineers managing infrastructure
• Document Editor for knowledge base curators managing RAG indexes

This prevents accidental modification of resources outside a user’s domain.

Next Steps

• Configure HMAC authentication for API request signing
• Set up data retention policies for compliance
• Manage users and invitations from the admin panel