UX Spec: ABAC Phase 2 (Channel Admin Controls)

Overview

This document outlines the user experience for Channel Admins to configure Attribute-Based Access Controls (ABAC) at the channel level via the Channel Settings modal in Mattermost.

This feature (Phase 2 of Attribute-Based Channel Access) builds on the Phase 1 foundations, enabling the set up of channel-specific access rules using existing user attributes, outside of the system console.

The goal is to allow Channel Admins to easily restrict channel membership based on user attributes while respecting system-wide policies and ensuring a seamless, accessible experience.

Goals

Empower Channel Admins: Allow Channel Admins to self-serve access control for their channels (within limits set by System Admins), reducing reliance on IT for managing confidential discussions.
Transparency and Confidence: Provide immediate feedback and testing tools so admins understand who would have access under the rules.
Non-Disruptive & Safe Configuration: Ensure that Channel Admins cannot inadvertently lock themselves (or all users) out of their own channels, and handle rule changes in a way that clearly communicates any impact (such as members being removed).
Consistency with Global Policies: Channel-level rules should add to (not override) any organization-wide access policies set by System Admins. The UI should reflect any global restrictions in effect so Channel Admins have the full context.

Channel Settings Modal

The Channel Settings modal will include a new tab called “Access Control” dedicated to channel-level access rules.

This tab is visible only to users with the necessary permissions, only for private channels, and only if the ABAC feature is enabled system-wide by a System Admin.

The UI will be presented in a basic, table-like form to list and manage simple attribute rules (Basic Mode), with no advanced policy syntax or code editor.

There will be no way to create or edit an Access Policy from the Channel Settings modal.

Global Policy Indicator (if applicable)

If any system-level access policies are applied to this channel (set from the System Console), it should be communicated with a non-dismissible section notice at the top. This would be informational to let the Channel Admin know there are additional constraints beyond what they configure. Channel Admins cannot edit or remove system access policies applied to the channel. The rules they add will be additive to these policies – meaning a user must satisfy both the global and channel-specific conditions to access.

Basic mode editor

Rule creation and editing in this UI should be identical to how it works in the Basic mode editor available in the policy editor of the System Console.

We do need to provide a way for channel admins to preview who matches the current rules. This can also be identical to the system console and be triggered via a Test Access Rules button below the rules list. The purpose is to let the admin verify the outcome of the rules before saving. The test logic should filter out users on the basis of any access policy applied in the System Console + the custom rules configured by the channel admin.

Auto-Add (Auto-Sync) Toggle

At the bottom of the rules list, a toggle switch allows the Channel Admin to enable or disable automatic membership synchronization based on the access rules. When “Auto-add members based on access rules” is enabled, any user who satisfies the channel’s rules will be automatically added to the channel, and users who no longer satisfy the rules will be removed when the rules are saved and in every subsequent sync. If this is off, the rules act as a gate (preventing unauthorized users from joining), but do not proactively add new qualifying members – users would need to be invited manually. The uses the existing Boolean switch configuration introduced in Phase 1 in the System Console Policy page.

The default state of this configuration is inherited from any system policies applied to the channel or is off by default if no policy is applied. There is a further restriction on what is allowed here based on the policy configuration:

If the system policy applied has “Auto-add members based on access rules: ✅ Enabled”, the channel admin should NOT be able to disable this for the channel.
If the system policy applied has “Auto-add members based on access rules: ❌ Disabled”, the channel admin can choose to enable it or keep it disabled for the channel.

Note: If no access policy and no valid channel rules are defined (empty/invalid state), this toggle should be unchecked and disabled (read-only) because there are no rules to sync on.

Validation (On Save)

On attempting to save, the system validates the rules. Robust validation is critical to prevent misconfigurations and to guide Channel Admins while they define rules. Below are key validation rules:

Required Fields: If the admin tries to save the changes while any rule row has an unselected attribute or an empty value, the we should highlight those fields in with an icon and display an error message (“Please select an attribute and value”)

Self-Exclusion Check: If the rules set would exclude the Channel Admin themselves, we need prevent the save action. An error message is shown (e.g., “You cannot set these rules because that will remove you from the channel.”). The admin must adjust the rules or reset their changes. (The admin’s own user attributes are checked behind the scenes against the new condition. If there are multiple channel admins, only the editing admin’s attributes are verified)

Conflicting Rules: In Basic Mode, Channel Admins are not expected to create conflicting rules (since all rules are combined with AND logic, they can only narrow access further). However, if the admin somehow adds two rules that can never be satisfied together (e.g., Custom rule configured: Department = Engineering, and rule from access policy: Department = Sales, a user cannot be in two departments at once), the result is that no user can satisfy both. Ideally this would already trigger the self-exclusion check and we don’t need an additional check here.

Confirmation modal

If there are no conflicts, when the Channel Admin updates the attribute-based access rules for a channel and clicks “Save”, a confirmation step is shown to ensure they understand the impact on channel membership before applying the changes.

This confirmation modal only appears if the new rules will cause one or more users to be added to or removed from the channel; if no membership change will occur, the rules are saved immediately with no extra prompt.

In the confirmation modal, the admin can either click Save and apply to confirm the changes, Cancel to abort and go back to editing, or choose View users for more detail about which members will be affected.

Upon clicking View users, the modal expands to display exactly who would be added or removed. Two tabs are provided: Allowed (X) and Restricted (Y) – where Allowed lists the X users who will be added or granted access to the channel, and Restricted lists the Y current members who will be removed based on the new rules.

Each tab shows a searchable, read-only list of user entries (display name and username for each user). No changes can be made in this view – it is purely for review. A Hide users toggle (or button) is available to collapse the detailed list and return to the summary view of the modal.
An inline search bar above the list allows the admin to filter the visible users. The search operates only on the currently selected tab’s list (either Allowed or Restricted).

Once saved, any updates to the rules should trigger a re-sync of channel membership immediately. Any current members who do not meet the new rules will now be removed from the channel (with appropriate system notifications or messages as needed). The Channel Admin who set the rule is guaranteed to still be in the channel (due to the self-exclusion check).

If the toggle for Auto-adding members based on access rules is enabled, users matching the access rules should also be immediately added to the channel after saving.
If auto-add is OFF, no new members are auto-added; the rules only constrain access (so a member would have to invite new members manually, at which point the rules would allow or disallow the action).

Edge Case – All Rules Removed: If the admin deletes all rules, and there is no system level access policy applied to the channel, the channel returns to a standard access state. In this cases, the toggle for Auto-adding members based on access rules cannot be enabled and is automatically turned off and disabled.