Role-Based Access Control (RBAC) System

This thread tracks the evolution of Slack's role management system, moving from broad, predefined roles to a granular Role-Based Access Control (RBAC) system. Initial posts detailed the limitations of existing roles (Guest, Member, Admin, Owner, Primary Owner) for enterprise organizations, where generic admin roles granted excessive permissions. This post details the design and implementation of a new RBAC system allowing users to be granted one or more roles with specific permissions, delegable at organization or workspace levels. It covers the data model (Permissions, Roles, Entities), the communication architecture using gRPC and Protocol Buffers between the webapp monolith and a new containerized Go permissions service, and the client-side architecture for displaying UI components based on permissions. The rollout strategy involved phased deployment from internal workspaces to pilot customers and eventually to all customers, with a dark mode/light mode transition for validation.