This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 142f12bd2b9 Update remaining FAB Website permissions rows for Airflow
3 (#74653)
142f12bd2b9 is described below
commit 142f12bd2b91624571f065eef0821381f246eae9
Author: CyberNative AI LLC <[email protected]>
AuthorDate: Wed Oct 14 00:28:20 2026 -0700
Update remaining FAB Website permissions rows for Airflow 3 (#74653)
---
providers/fab/docs/auth-manager/access-control.rst | 78 ++++++++++------------
1 file changed, 37 insertions(+), 41 deletions(-)
diff --git a/providers/fab/docs/auth-manager/access-control.rst
b/providers/fab/docs/auth-manager/access-control.rst
index 3a33a27357b..4677f428e62 100644
--- a/providers/fab/docs/auth-manager/access-control.rst
+++ b/providers/fab/docs/auth-manager/access-control.rst
@@ -822,35 +822,33 @@ Website Permissions
Action Permissions
Minimum Role
======================================
=======================================================================
============
Access homepage Website.can_read
Viewer
-Show Browse menu Browse.menu_access
Viewer
Show Dags menu Dags.menu_access
Viewer
Get Dag stats Dags.can_read, Dag Runs.can_read
Viewer
-Show Task Instances menu Task Instances.menu_access
Viewer
Get Task stats Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
Get last Dag runs Dags.can_read, Dag Runs.can_read
Viewer
Get Dag code Dags.can_read, Dag Code.can_read
Viewer
Get Dag details Dags.can_read, Dag Runs.can_read
Viewer
-Show Dag Dependencies menu Dag Dependencies.menu_access
Viewer
-Get Dag Dependencies Dag Dependencies.can_read
Viewer
-Get rendered Dag Dags.can_read, Task Instances.can_read
Viewer
-Get Logs with metadata Dags.can_read, Task Instances.can_read,
Task Logs.can_read Viewer
-Get Log Dags.can_read, Task Instances.can_read,
Task Logs.can_read Viewer
-Redirect to external Log Dags.can_read, Task Instances.can_read,
Task Logs.can_read Viewer
+Get Dag Dependencies Dags.can_read, Dag
Dependencies.can_read Viewer
+Get rendered Dag Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
+Get Logs with metadata Dags.can_read, Dag Runs.can_read, Task
Instances.can_read, Viewer
+ Task Logs.can_read
+Get Log Dags.can_read, Dag Runs.can_read, Task
Instances.can_read, Viewer
+ Task Logs.can_read
+Redirect to external Log Dags.can_read, Dag Runs.can_read, Task
Instances.can_read, Viewer
+ Task Logs.can_read
Get Task Dags.can_read, Task Instances.can_read
Viewer
Show XCom menu XComs.menu_access
Op
Get XCom Dags.can_read, Task Instances.can_read,
XComs.can_read Viewer
-Create XCom XComs.can_create
Op
-Delete XCom XComs.can_delete
Op
-Triggers Task Instance Dags.can_edit, Task
Instances.can_create User
+Create XCom Dags.can_edit, XComs.can_create
Op
+Delete XCom Dags.can_edit, XComs.can_delete
Op
Delete Dag Dags.can_delete
User
-Show Dag Runs menu Dag Runs.menu_access
Viewer
Trigger Dag run Dags.can_edit, Dag Runs.can_create
User
-Clear Dag Dags.can_edit, Task
Instances.can_delete User
-Clear Dag Run Dags.can_edit, Task
Instances.can_delete User
+Clear Dag Dags.can_edit, Dag Runs.can_edit, Task
Instances.can_edit User
+Clear Dag Run Dags.can_edit, Dag Runs.can_edit
User
Mark Dag Run as failed DAGS.can_edit, Dag Runs.can_edit
User
Mark Dag Run as success DAGS.can_edit, Dag Runs.can_edit
User
-Mark Task as failed Dags.can_edit, Task Instances.can_edit
User
-Mark Task as success Dags.can_edit, Task Instances.can_edit
User
+Mark Task as failed Dags.can_edit, Dag Runs.can_edit, Task
Instances.can_edit User
+Mark Task as success Dags.can_edit, Dag Runs.can_edit, Task
Instances.can_edit User
Get Dag as grid Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
Get Dag as graph Dags.can_read, Dag Runs.can_read, Task
Instances.can_read, Viewer
Dag Dependencies.can_read
@@ -858,56 +856,54 @@ Get Dag as duration graph Dags.can_read, Dag
Runs.can_read, Task In
Show all tries Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
Toggle Dag paused status Dags.can_edit
User
Show Gantt Chart Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
-Get external links Dags.can_read, Task Instances.can_read
Viewer
-Show Task Instances Dags.can_read, Task Instances.can_read
Viewer
+Get external links Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
+Show Task Instances Dags.can_read, Dag Runs.can_read, Task
Instances.can_read Viewer
Show Configurations menu Configurations.menu_access
Op
-Show Configs Configurations.can_read
Viewer
+Show Configs Configurations.can_read
Op
Delete multiple records Dags.can_edit
User
-Set Task Instance as running Dags.can_edit
User
-Set Task Instance as success Dags.can_edit
User
-Set Task Instance as up_for_retry Dags.can_edit
User
+Set Task Instance as success Dags.can_edit, Dag Runs.can_edit, Task
Instances.can_edit User
Autocomplete Dags.can_read
Viewer
Show Asset menu Assets.menu_access
Viewer
Show Assets Assets.can_read
Viewer
-Show Docs menu Docs.menu_access
Viewer
-Show Documentation menu Documentation.menu_access
Viewer
+Show REST API Reference link Documentation.menu_access
Viewer
Show Jobs menu Jobs.menu_access
Viewer
-Show Audit Log Audit Logs.menu_access
Viewer
+Show Audit Log Audit Logs.menu_access
Admin
Reset Password My Password.can_read, My
Password.can_edit Viewer
-Show Permissions menu Permission Views.menu_access
Admin
+Show Permissions menu Permission Pairs.menu_access
Admin
List Permissions Permission Views.can_read
Admin
Get My Profile My Profile.can_read
Viewer
Update My Profile My Profile.can_edit
Viewer
-List Logs Audit Logs.can_read
Viewer
+List Logs Dags.can_read, Audit Logs.can_read
Admin
List Jobs Jobs.can_read
Viewer
-List Plugins Plugins.can_read
Viewer
-Show Plugins menu Plugins.menu_access
Viewer
+List Plugins Plugins.can_read
Op
+Show Plugins menu Plugins.menu_access
Op
Show Providers menu Providers.menu_access
Op
List Providers Providers.can_read
Op
-List Task Reschedules Task Reschedules.can_read
Admin
-Show Triggers menu Triggers.menu_access
Admin
-List Triggers Triggers.can_read
Admin
-Show Admin menu Admin.menu_access
Viewer
Show Connections menu Connections.menu_access
Op
-Show Pools menu Pools.menu_access
Viewer
+Show Pools menu Pools.menu_access
Op
Show Variables menu Variables.menu_access
Op
-Show Roles menu Roles.menu_access
Admin
+Show Roles menu List Roles.menu_access
Admin
List Roles Roles.can_read
Admin
Create Roles Roles.can_create
Admin
Update Roles Roles.can_edit
Admin
Delete Roles Roles.can_delete
Admin
-Show Users menu Users.menu_access
Admin
+Show Users menu List Users.menu_access
Admin
Create Users Users.can_create
Admin
Update Users Users.can_edit
Admin
Delete Users Users.can_delete
Admin
Reset user Passwords Passwords.can_edit, Passwords.can_read
Admin
======================================
=======================================================================
============
-The Grid, Graph and Gantt views, the duration charts and the list of task
tries check
-Dag Runs.can_read and Task Instances.can_read on the resources themselves. A
Dag-specific
-``DAG Run:example_dag_id.can_read`` permission does not replace Dag
Runs.can_read for these
-views. Granting these permissions does not expose other Dags, because the
Dag-level check
-(``DAGs.can_read`` or ``DAG:example_dag_id.can_read``) still applies.
+The Grid, Graph and Gantt views, the duration charts, the list of task tries,
the Task Instances
+list and the task instance pages (logs, rendered templates and external links)
check
+Dag Runs.can_read and Task Instances.can_read on the resources themselves.
Marking or clearing
+task instances checks Dag Runs.can_edit and Task Instances.can_edit in the
same way. A
+Dag-specific ``DAG Run:example_dag_id`` permission does not replace these Dag
Runs permissions.
+Granting these permissions does not expose other Dags, because the Dag-level
check (for example
+``DAGs.can_read`` or ``DAG:example_dag_id.can_read``) still applies.
+
+The Browse and Admin menus have no permission of their own. They show the
entries that the
+user has permissions for. The Docs menu is shown to all users.
These Dag-level controls can be set directly through the UI / CLI, or encoded
in the dags themselves through the access_control arg.
