### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [12 בדצמבר, 2020, 1:56pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/21 "2020-12-12T13:56:59Z")
Sorry old post but why don’t you set up your theme as a repo in GitHub? Permission your design and UX team to have access to update the Theme in GitHub.
In Discourse you can now set Themes to auto update upon rebuild.
Your admins will now only need to rebuild to bring in any changes made by the Design and UX team and the latter will not need access to admin at all.
---
### Author:  [@neounix](https://meta.discourse.org/u/neounix)
#### Post date: [13 בדצמבר, 2020, 2:32am UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/22 "2020-12-13T02:32:20Z")
Just a short note:
When coding matters of access control, in general, these RBAC checks should be performed on the server side.
RBAC code in client-side Javascript can be manipulated by the client.
This means that when defining core RBAC permissions for staff, admins and moderators, this should be done (generally speaking) in Rails, not in Javascript.
OBTW, this is also how Discourse does RBAC now, using what Discourse calls “guardian”, a Ruby class called `class Guardian`, here:
>
If a developer is going to add RBAC checks in Javascript code by calling the Discourse API, keep in mind that this code can be compromised because code which runs in the browser can be manipulated.
My recommendation is to make sure all core RBAC code is performed on the server side and do not try to short cut this in client-side Javascript.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [17 בדצמבר, 2020, 6:31am UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/23 "2020-12-17T06:31:03Z")
There is also trust level 4 and category moderators, in discourse 2.5 and beyond.
---
### Author:  [@nicolailang](https://meta.discourse.org/u/nicolailang)
#### Post date: [5 ביוני, 2021, 9:43am UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/24 "2021-06-05T09:43:04Z")
> [@dgateles](#):
>
> We have UX and Design teams and they are only responsible for that area, so only access to the themes would be necessary.
I have a similar use case, in that I run a small non-profit community where one of our users is maintaining the themes and design.
I do not wish to give anyone beside me and my co-owner access to private user data (e-mail addresses etc.), but I do have 4 moderators.
In order for the designer to work, I’ve had to create a copy site with no content where he is the admin, and I then copy themes and components manually. However it is not desirable since some changes requires content in order to proof.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [6 ביוני, 2021, 9:13pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/25 "2021-06-06T21:13:49Z")
Why not add some content to the staging / testing site? That’d be the typical recommendation.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [7 ביוני, 2021, 1:03am UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/26 "2021-06-07T01:03:33Z")
So let the developer develop on the staging site, and push the themes to github. But you’ll still need to upgrade them yourself. You might contrive to do the upgrade with the API and somehow make the developer be able to trigger it.
I’m working of a tool that might be able to help with that.
---
### Author:  [@AV\_C](https://meta.discourse.org/u/AV_C)
#### Post date: [9 במרץ, 2023, 3:37pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/27 "2023-03-09T15:37:54Z")
> [@nicolailang](#):
>
> In order for the designer to work, I’ve had to create a copy site with no content where he is the admin, and I then copy themes and components manually. However it is not desirable since some changes requires content in order to proof.
We have this exact need as well, did anyone by any chance solve this?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [9 במרץ, 2023, 4:06pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/28 "2023-03-09T16:06:52Z")
I don’t know if this is useful in this situation, but if you just need some content there is the `populate` rake task:
> [@Set up a staging server](https://meta.discourse.org/t/set-up-a-staging-server/225951/1):
>
> #### Seeding a Test Server
>
> If you want a staging server, then you should populate it with your actual data from your actual forum via a `Restore`. Sometimes it is your particular data that is causing the issue, and testing your forum with some other set of data can give you a sense of false hope.
>
> If what you want is a test server to see what Discourse is like, though, you might want to check things out with some fake data, and if you do, you can do this:
>
> ```plaintext
> ./launcher enter app
> ALLOW_DEV_POPULATE=1 bundle install
> ALLOW_DEV_POPULATE=1 rake dev:populate
>
> ```
>
> This will seed your forum with some fake data so that you can see what things look like with whatever themes and plugins you want. If you haven’t started your forum yet, this will give you some idea what things are likely to look like.
---
### Author:  [@AV\_C](https://meta.discourse.org/u/AV_C)
#### Post date: [9 במרץ, 2023, 4:40pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/29 "2023-03-09T16:40:30Z")
Thank you, unfortunately it’s not really useful atm.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [9 במרץ, 2023, 4:44pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/30 "2023-03-09T16:44:21Z")
> [@AV\_C](#):
>
> We have this exact need as well, did anyone by any chance solve this?
If you don’t trust the designer to see your data what solution would you imagine?
You could give them just an API key that would let them use the discourse\_cli to push the theme there and then disable it when they were through, maybe?
---
### Author:  [@AV\_C](https://meta.discourse.org/u/AV_C)
#### Post date: [9 במרץ, 2023, 5:09pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/31 "2023-03-09T17:09:19Z")
There is absolutely no reason a designer should have access to 100k users lol. Also, it would be against GDPR rules. Is it possible to give a cli key just for theme updates?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [9 במרץ, 2023, 5:17pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/32 "2023-03-09T17:17:34Z")
Begging your pardon! I think you’re right.
Now, unlike when this topic was created (which apparently was where my brain was when I wrote my reply), we **do** have granular API keys. It should not be too hard to add a new scope just for theme management.
It might be worth creating a new topic in #Contribute > Feature asking for a theme-developer API key scope. That seems like a fine idea.
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [9 במרץ, 2023, 5:58pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/33 "2023-03-09T17:58:27Z")
> [@AV\_C](#):
>
> it would be against GDPR rules
No, it is not. It can be against rules of that site, but those can and should change.
---
### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [9 במרץ, 2023, 7:10pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/34 "2023-03-09T19:10:57Z")
It would be good if @AV_C can maybe post a reference to this _tequirement_. Though I can strongly appreciate why a client would want to restrict access to the user base and even private categories due to a variety of reasons. Full Admin can access member’s sign up emails and private categories may contain other sensitive content depending on client’s use case.
I think @pfaffman has a good idea to ensure this kind of gap can be covered through restricted admin api. Once designer work comopleted key can be revoked until needed.
This would also fit Jay’s idea of not showing a user as admin on About page.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [29 באפריל, 2023, 3:21pm UTC](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545/35 "2023-04-29T15:21:14Z")
[Previous page](https://meta.discourse.org/t/how-to-define-custom-permissions-for-staff-admins-moderators/122545.md?page=1)