# "All members" when creating a category assigns everyone
**URL:** https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508
**Category:** UX
**Tags:** categories
**Created:** [August 7, 2026, 8:17am UTC](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508 "2026-08-07T08:17:11Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 7, 2026, 8:17am UTC](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508/1 "2026-08-07T08:17:11Z")
So when you have a forum and it’s set to “login required”, the “create new category” offers the choice between “all members” and “private”. When it’s not set to login required it changes to “public” and “private”.
However, in both situations the left button assigns `everyone`.
Now this happens:
- I am setting up a new forum
- I set it to login required because I’m still setting it up
- I create a category and choose “all members”
- It assigns `everyone`
- I open up the forum to the public by disabling `login required`
- The category is accessible for anonymous, non logged in, users
- Panic 😱
Expected:
- when the button says “all members”, it assigns `trust_level_0` or the fancy new `logged_in_users`.
Also, this made me realize that when the [new granular permissions feature](https://meta.discourse.org/t/granular-group-based-permissions-for-anonymous-and-logged-in-users/402273) is enabled it does not apply to category permissions. Which is REALLY confusing.
---
### Author:  [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [August 7, 2026, 8:19am UTC](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508/2 "2026-08-07T08:19:35Z")
@martin Thoughts? Not sure how to tackle but does seem less than ideal
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 7, 2026, 9:28am UTC](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508/3 "2026-08-07T09:28:06Z")
Suggestion: have three buttons instead of two
- public (disable when login required) → assign `everyone`
- members only → assign `trust_level_0` or the fancy new `logged_in_users`
- private → assign selected groups.
Related bug [Category permissions and the new permission groups](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511)
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [August 10, 2026, 3:11am UTC](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508/4 "2026-08-10T03:11:18Z")
Yes my intent was to not really change category permissions much with this upcoming change, so these (this and [Category permissions and the new permission groups - #5 by martin](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511/6) ) are more unintended side effects. I don’t intend to remove `everyone` yet as an option from category permissions…but over time I think it’s probably a good idea to do a fast follow up on this.
The problem is that I was thinking it would be even less clear what I should migrate `everyone` category permissions to, but maybe it can follow logic like you are suggesting? E.g. if I remove `everyone`, a migration would add these category permissions for a site:
- Site requires login → `everyone` becomes `logged_in_users`
- Site is public/doesn’t require login → `everyone` becomes `logged_in_users` AND `anonymous_users`, two separate category permissions
> [@RGJ](#):
>
> Suggestion: have three buttons instead of two
>
> - public (disable when login required) → assign `everyone`
> - members only → assign `trust_level_0` or the fancy new `logged_in_users`
> - private → assign selected groups.
I think this suggestion makes the most sense, and is the clearest, so I will make that change when I can.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 10, 2026, 8:21am UTC](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508/6 "2026-08-10T08:21:20Z")
> [@martin](#):
>
> so these (this and [Category permissions and the new permission groups - #5 by martin](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511/6) ) are more unintended side effects. I don’t intend to remove `everyone` yet as an option from category permissions…but over time I think it’s probably a good idea to do a fast follow up on this.
>
> The problem is that I was thinking it would be even less clear what I should migrate `everyone` category permissions to, but maybe it can follow logic like you are suggesting? E.g. if I remove `everyone`, a migration would add these category permissions for a site:
I think it’s best to continue that discussion in that topic so I will respond there.
This specific issue with the public/members/private buttons is relatively simple and that change will resolve it.