introduce custom Team member roles and have them reflect in apps.

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

There is a role concept in Teams, and each role has defined permissions. This is not reflected in apps (for example, team moderators are not moderators in Talk rooms owned by the team). It is also limited to a small number of roles (owner, admin, moderator and member).

Request: introduce custom Team member roles and have them reflect in apps.

Use case:

There are different roles in a team that works together on a task. Ideally, these can be reflected in Teams and access to the resources it owns.

As team owner/admin:

• I want to delegate the management of ACL's in a team folder to one or more specific team members.
• I want to ensure all team moderators are also moderator in our Talk rooms.
• I want to only allow two specific team members to be able to create new Deck boards for the team.

Details:

Right now, Teams has the roles owner, admin, moderator and member. We want to add a 'guest' role in the future.

We could try to map these in the apps, for example:

• Only owners and admins can manage ACL's in Teamfolders
• Only owners and admins can create new Talk rooms for the team
• Moderator role and up are managers of all Deck boards
• Moderator role and up are moderator of all team-owned Talk rooms
• Moderator role and up can modify permission of Deck boards
• Guests can not edit anything in Deck boards and Collectives

This makes sense as a 1.0 version of this feature:

• expose the team role to apps
• apps map them to internal roles

But this could run into limitations. You might want to give the right to create Deck boards to few people, without also making them moderator in Talk, for example. So for 2.0, a different approach makes sense: custom roles. In short:

Apps should register permissions/roles relevant to them. Then the team managers can create roles that have a combination of permissions and assign them to team members.

So you would get a table like:

Role	Permissions
Admin	[edit]
Moderator	[edit]
Nember	[edit]
Guest	[edit]
Custom	[edit]
[add custom role]

And when you click edit:

Application	Permissions
Talk	Can create Talk rooms
Talk	Can delete Talk rooms
Talk	Room moderator
Deck	Can create Deck boards
Deck	Can delete Deck boards
Deck	Can manage Deck boards
Files	Can manage ACLs
Collectives	Can create Collectives

Note:

Is this to set sharing/read-write permissions for members?

Blocking sharing of resources outside a Team can be a helpful way to ensure absolute clarity about access: only team members have access to team resources, period. Therefor, we conceive allowing re-sharing of team owned resources as a team-wide setting: https://github.com/nextcloud/circles/issues/2645

It is unclear to me if it makes sense to, in addition, allow for managing this on a per-role level, for example:

guests can not re-share resources

Next is the question of managing it per-app level. That seems even more complicated: a certain role is allowed to re-share Talk rooms and Deck boards but not files. Is that really needed?

Should it be possible to set permissions on a resource level?

Sub teams are probably a better approach for this?