From d27d5cad43c18ac2c2946659fca649d5c939156f Mon Sep 17 00:00:00 2001 From: Lee Calcote Date: Mon, 26 Oct 2026 17:07:44 -0500 Subject: [PATCH 1/3] docs(cloud): the person a profile represents can read it Signed-off-by: Lee Calcote --- content/en/cloud/concepts/spaces/profiles.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/cloud/concepts/spaces/profiles.md b/content/en/cloud/concepts/spaces/profiles.md index f3ef633dd06..1aa8eead386 100644 --- a/content/en/cloud/concepts/spaces/profiles.md +++ b/content/en/cloud/concepts/spaces/profiles.md @@ -26,7 +26,7 @@ A profile is visible to: - the Organization Admins of its organization, and - members of any team assigned to a workspace the profile is assigned to. -The owner always sees their own profile, whether or not it is in a workspace and even without the **View Profiles** permission. Organization Admins and workspace members also need **View Profiles**. Provider Admins do not see profiles automatically. Seeing a profile does not give you access to its linked connections, which keep their own access rules. +The owner always sees their own profile, whether or not it is in a workspace and even without the **View Profiles** permission. The person a profile represents can also read it, so when an admin creates a profile for you, it appears in your profile list and you can open it, even without **View Profiles**. That is read-only: changing the profile, linking connections and seeing its connections still follow the rules on this page. Organization Admins and workspace members also need **View Profiles**. Provider Admins do not see profiles automatically. Seeing a profile does not give you access to its linked connections, which keep their own access rules. A profile that is in no workspace is visible only to its owner and the organization's admins. What you can change is never wider than what you can see: a profile you cannot see answers 404, the same as one that does not exist. @@ -40,7 +40,7 @@ When the owner's account is deleted, the profile passes to the earliest Organiza | Permission | Allows | | --- | --- | -| View Profiles | Listing and reading the profiles you can see, and their connections. Owners read their own profiles without it. | +| View Profiles | Listing and reading the profiles you can see, and their connections. Owners read their own profiles without it, and the person a profile represents can read that profile without it. | | Create Profile | Creating a profile in an organization | | Edit Profile | Editing any visible profile, transferring its ownership, and linking or unlinking connections | | Delete Profile | Deleting a profile | From 0bb5aded381e0b75df5826d856e02fa0e582d1a2 Mon Sep 17 00:00:00 2001 From: Marcus <158522975+marblom007@users.noreply.github.com> Date: Mon, 2 Nov 2026 00:44:24 +0000 Subject: [PATCH 2/3] docs(cloud): include the represented user in the no-workspace and pre-assignment visibility rules The concept page and the managing-profiles guide both stated a profile in no workspace is visible only to its owner and the organization's admins, contradicting the page's own represented-user read rule and meshery-cloud #6340, under which the user a profile represents can list and read it without View Profiles, including before assignment. Also apply the two LanguageTool style nits on the same concept-page paragraph. Signed-off-by: Marcus <158522975+marblom007@users.noreply.github.com> --- content/en/cloud/concepts/spaces/profiles.md | 4 ++-- content/en/cloud/guides/workspaces/managing-profiles/index.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/cloud/concepts/spaces/profiles.md b/content/en/cloud/concepts/spaces/profiles.md index 1aa8eead386..1f4e2d39970 100644 --- a/content/en/cloud/concepts/spaces/profiles.md +++ b/content/en/cloud/concepts/spaces/profiles.md @@ -26,9 +26,9 @@ A profile is visible to: - the Organization Admins of its organization, and - members of any team assigned to a workspace the profile is assigned to. -The owner always sees their own profile, whether or not it is in a workspace and even without the **View Profiles** permission. The person a profile represents can also read it, so when an admin creates a profile for you, it appears in your profile list and you can open it, even without **View Profiles**. That is read-only: changing the profile, linking connections and seeing its connections still follow the rules on this page. Organization Admins and workspace members also need **View Profiles**. Provider Admins do not see profiles automatically. Seeing a profile does not give you access to its linked connections, which keep their own access rules. +The owner always sees their own profile, whether it is in a workspace and even without the **View Profiles** permission. The person a profile represents can also read it, so when an admin creates a profile for you, it appears in your profile list and you can open it, even without **View Profiles**. That is read-only: changing the profile, linking connections and seeing its connections still follow the rules on this page. Organization Admins and workspace members also need **View Profiles**. Provider Admins do not see profiles automatically. Seeing a profile does not provide access to its linked connections, which keep their own access rules. -A profile that is in no workspace is visible only to its owner and the organization's admins. What you can change is never wider than what you can see: a profile you cannot see answers 404, the same as one that does not exist. +A profile that is in no workspace is visible only to its owner, the person it represents, and the organization's admins. What you can change is never wider than what you can see: a profile you cannot see answers 404, the same as one that does not exist. ## Owner and succession diff --git a/content/en/cloud/guides/workspaces/managing-profiles/index.md b/content/en/cloud/guides/workspaces/managing-profiles/index.md index bd59bcffb20..e2cd69010a0 100644 --- a/content/en/cloud/guides/workspaces/managing-profiles/index.md +++ b/content/en/cloud/guides/workspaces/managing-profiles/index.md @@ -29,7 +29,7 @@ Each action needs the permission named beside it. A profile you cannot see, one } ``` -`organizationId` and `name` are required. You become the owner unless you send `owner`. `owner` and `userId`, when sent, must each be a signed-in member of the organization, or the request answers 400. A new profile is in no workspace, so only you and the organization's admins can see it until you assign it. +`organizationId` and `name` are required. You become the owner unless you send `owner`. `owner` and `userId`, when sent, must each be a signed-in member of the organization, or the request answers 400. A new profile is in no workspace, so you, the user it represents, and the organization's admins can see it until you assign it. ## Edit or transfer a profile From 215fd12aba6981b73276285c06a902a441749bf1 Mon Sep 17 00:00:00 2001 From: Marcus <158522975+marblom007@users.noreply.github.com> Date: Mon, 2 Nov 2026 00:53:58 +0000 Subject: [PATCH 3/3] docs(cloud): clarify the View Profiles exception for workspace members Organization Admins and workspace members need View Profiles unless they are the profile's owner or the person it represents, who can read it without that permission. Signed-off-by: Marcus <158522975+marblom007@users.noreply.github.com> --- content/en/cloud/concepts/spaces/profiles.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/cloud/concepts/spaces/profiles.md b/content/en/cloud/concepts/spaces/profiles.md index 1f4e2d39970..4d88b4e480d 100644 --- a/content/en/cloud/concepts/spaces/profiles.md +++ b/content/en/cloud/concepts/spaces/profiles.md @@ -26,7 +26,7 @@ A profile is visible to: - the Organization Admins of its organization, and - members of any team assigned to a workspace the profile is assigned to. -The owner always sees their own profile, whether it is in a workspace and even without the **View Profiles** permission. The person a profile represents can also read it, so when an admin creates a profile for you, it appears in your profile list and you can open it, even without **View Profiles**. That is read-only: changing the profile, linking connections and seeing its connections still follow the rules on this page. Organization Admins and workspace members also need **View Profiles**. Provider Admins do not see profiles automatically. Seeing a profile does not provide access to its linked connections, which keep their own access rules. +The owner always sees their own profile, whether it is in a workspace and even without the **View Profiles** permission. The person a profile represents can also read it, so when an admin creates a profile for you, it appears in your profile list and you can open it, even without **View Profiles**. That is read-only: changing the profile, linking connections and seeing its connections still follow the rules on this page. Organization Admins and workspace members also need **View Profiles**, unless they are the owner or the person the profile represents. Provider Admins do not see profiles automatically. Seeing a profile does not provide access to its linked connections, which keep their own access rules. A profile that is in no workspace is visible only to its owner, the person it represents, and the organization's admins. What you can change is never wider than what you can see: a profile you cannot see answers 404, the same as one that does not exist.