# Category permissions and the new permission groups

**URL:** https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511
**Category:** Bug
**Created:** [7 augustus 2026 om 09:32 UTC](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511 "2026-08-07T09:32:04Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [10 augustus 2026 om 08:41 UTC](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511/7 "2026-08-10T08:41:46Z")

</div>

From your response in the other topic

> [@"All members" when creating a category assigns everyone](https://meta.discourse.org/t/all-members-when-creating-a-category-assigns-everyone/409508/4):
>
> so these (this and [Category permissions and the new permission groups - #6](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511/6) ) are more unintended side effects. I don’t intend to remove `everyone` yet as an option from category permissions…but over time I think it’s probably a good idea to do a fast follow up on this.
> 
> The problem is that I was thinking it would be even less clear what I should migrate `everyone` category permissions to, but maybe it can follow logic like you are suggesting? E.g. if I remove `everyone`, a migration would add these category permissions for a site:
> 
> 1. Site requires login → `everyone` becomes `logged_in_users`
> 2. Site is public/doesn’t require login → `everyone` becomes `logged_in_users` AND `anonymous_users`, two separate category permissions

The more I think about this the more I worry about this.

What happens if I only add `anonymous_users` to a category and don’t add `logged_in_users` ?  
What happens if I add `anonymous_users` while my forum is `login_required` ?

Also, the current technical implementation is that when category permissions are set to `everyone`, there is simply no entry in `category_groups` and `read_restricted` is set to `false`.

That is very simple and straightforward: if there are no permissions set then the permissions are determined by the global forum permissions (the `login_required` setting) and no further restrictions apply.

So making this change would be adding a huge amount of complexity and weird combinations would be possible (you could do `anonymous users` and `staff` 😬 )

My suggestion would be:

- remove `anonymous_users` as an option for category permissions altogether
- keep `everyone` and `logged_in_users`
- remove `trust_level_0` as an option since it equals `logged_in_users`

or alternatively, but maybe less clear for less experienced admins

- remove `anonymous_users` and `logged_in_users` as an option for category permissions
- keep `everyone` (and TL0)

In all cases, keep `everyone`. And you won’t need a migration either 😉

---

_[View the full topic](https://meta.discourse.org/t/category-permissions-and-the-new-permission-groups/409511)._