Three-Layer Role Architecture
Introduced separate Platform, Workspace, and Project role domains so global administration permissions no longer determine access to private Workspace or Project resources.
v21062026114
Forge Platform v21062026114 - Scoped Access Control & Permissions Overhaul
This release also introduces dynamic scoped-role management, stronger privacy enforcement across the platform, dedicated Vault authorization, clearer access-management workflows, and multiple regression fixes discovered during final staging preparation.
Jun 21, 2026
Detailed Body
Forge’s authorization system has been rebuilt around clearly separated Platform, Workspace, and Project roles. Private-resource access is now determined through ownership, normalized memberships, scoped capabilities, and direct record-level grants rather than broad Platform roles.
This release also introduces dynamic scoped-role management, stronger privacy enforcement across the platform, dedicated Vault authorization, clearer access-management workflows, and multiple regression fixes discovered during final staging preparation.
Added
Dynamic Workspace and Project Roles
Added database-managed Workspace and Project roles that administrators can create, rename, configure, activate, and deactivate directly from the Management Hub.
Scoped Capability Management
Added configurable capability mappings for Workspace and Project roles, allowing access rules to be managed without modifying application code.
Workspace and Project Role Assignments
Added dedicated workflows for assigning users to Workspace and Project roles independently, including support for different roles across different resources.
Changed
Ownership-Aware Workspace and Project Access
Workspace and Project ownership are now treated as independent authorization sources and no longer require duplicate membership records.
Authorization Rollback Controls
Legacy compatibility infrastructure remains available through explicit environment rollback switches, while normalized authorization is now the default authority.
Security
Normalized Private-Resource Authorization
Workspace, Project, task, note, comment, attachment, approval, report, notification, and Vault access now uses normalized ownership, membership, capability, and direct-grant checks.
Removed Platform Role Private-Access Overrides
Platform roles such as Admin, Developer, Tester, Manager, Support, and Sales no longer automatically grant access to private Workspaces, Projects, or their related content.
Direct Task Grant Isolation
Users with a direct task grant can access the granted task without receiving broader access to the entire Project or its other private content.
Performance
Authorization Cache Improvements
Scoped-role definitions and capability mappings are cached and refreshed when role configuration changes, reducing repeated database queries.