Directus Basics Part 3 — User Roles & Permissions
This is part three of our Directus Basics series. In part one we set up our instance, and in part two we covered relationships between collections. Today we're covering access control — what determines who can see and touch your data. The Core Concepts Access control in Directus comes down to three terms: Permission — applies to one collection and one action (create, read, update, delete, or…
This is part three of our Directus Basics series. We're discussing access control, which determines who can see and manipulate data in your Directus instance. There are three key terms: Permission, Policy, and Role. Permissions apply to a single collection and action (create, read, update, delete, or share), and can be full access, no access, or custom rules.
Policies group permissions together and can be assigned to users or roles. Roles define a user's position within a project and can have multiple policies, apply to multiple users, and have child roles.
If an administrator creates a user without assigning a role, the user cannot access the Data Studio. The missing piece is that the role must have an access policy attached. Access control in Directus flows in this order: Access Policy → Role → User. This means you first define what level of access a user needs, build an access policy to match, create a role and attach that policy to it, and finally register the user and assign them to the role.
Every fresh Directus instance comes with two default policies: Administrator, which has unrestricted access, and Public, which has Read access only for visible data. When giving a collection Public Access, set permissions to Read and choose All Access. Create a custom access policy for a data-entry team member, for example, by naming it DataEntry, checking App Access, and adding the 'products' collection with Read access.
Then, create the user role with this policy and create the user under the User Directory. Assign the 'DataEntry' role to the user.
Log in as the new user, and you'll see the products collection, but attempting to edit any field will not work, as only Read access was granted. The product image is also missing. To fix this, add the 'directus_files' collection with Read access to the 'DataEntry' policy. This allows the user to view the product image. You can also extend access to related collections by adding them to the DataEntry policy with Read access.
Custom field-level permissions allow you to restrict access down to individual fields. For example, you can allow the data-entry user to update only the 'name' field on products. Custom permission rules give you fine-grained control over user access.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
