--- title: "Manage ABAC Rooms and Attributes" slug: "manage-abac-rooms-and-attributes" tags: ["Defense"] updated: 2026-06-22T17:01:50Z published: 2026-06-22T17:01:50Z canonical: "docs.rocket.chat/manage-abac-rooms-and-attributes" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt > Use this file to discover all available pages before exploring further. # Manage ABAC Rooms and Attributes ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Defense.svg) Room attributes define the classification model for ABAC-managed rooms. They represent the resource-side conditions used during access evaluation and are matched against user attributes synchronized from LDAP. Before any room can be governed by ABAC, its required attributes and allowed values must first be defined here. Room attributes act as a controlled vocabulary for room restrictions. Only values defined at this level can later be applied to rooms, ensuring consistency, validation, and auditability across the system. ## Manage room attributes > [!WARNING] > **Required permissions**: > > To access this section, admins need the **Manage ABAC configuration** permission (to see the ABAC admin area at all) and the **Manage ABAC room attributes** permission (to view and edit the Room Attributes tab). Both can be assigned at **Manage → Workspace → Permissions** by editing the relevant role. To manage global room attributes, navigate to: **Manage → Workspace → Attribute Based Access Control → Room Attributes.** This section displays the central attribute registry used by all ABAC-managed rooms across the workspace. The **Room Attributes** page provides a searchable list of all existing attributes and their allowed values. Each entry contains: - **Name**: the attribute identifier used by ABAC policies - **Value**: the full set of allowed values that may be assigned to rooms For example: - A `department` attribute may include values such as `engineering`, `finance` etc. - A `employmentType` attribute may include values such as `fullTime`, `Contractor` etc. These attributes do not grant access on their own. They function strictly as **room-side constraints**, which are later enforced by matching them against LDAP-synchronized user attributes. ### Creating a new room attribute New room attributes are created from the **Room Attributes** tab and become immediately available for use across all ABAC-managed rooms. To create a new attribute: 1. Open the **Room Attributes** tab and select **New attribute**. 2. Enter a value in the **Name** field. 3. Enter a value in the **Values** field and select **Add Value**. 4. Repeat until all required values have been added. 5. Select **Save** to finalize the attribute. Once saved, the attribute becomes part of the **global ABAC attribute repository** and can be applied to rooms immediately. ### Attribute validation rules Room attributes enforce strict validation to prevent misconfiguration and ensure predictable enforcement behavior. Attribute names must conform to the following pattern: ```plaintext ^[A-Za-z0-9_-]+$ ``` This means: - Only alphanumeric characters, underscores (`_`), and hyphens (`-`) are permitted. - Spaces, symbols, and special characters are rejected. - Invalid names trigger an immediate validation error and prevent saving. - Attribute names are case sensitive and must exactly match the attribute name configured in the LDAP mapping settings. This restriction ensures compatibility with policy evaluation and backend enforcement. ### Attribute value requirements Each attribute must contain **at least one allowed value**. Values are added individually and validated at the time of entry. - Empty values are rejected. - Duplicate values are not permitted. - The system displays a **“Values required”** error if no values are defined. - Attribute values are case sensitive and must exactly match the values imported from LDAP. Values represent the **exact classification options** that administrators can later assign to rooms. ### Editing an existing room attribute Once a room attribute has been created, its **structure is locked**, but its values can still be managed. To edit an existing attribute: 1. Locate the attribute you want to modify. 2. Click the kebab menu **(⋮)** at the end of the row and select **Edit**. The **Edit Attribute** dialog opens with the following behavior: - The attribute name is editable. - Existing **attribute values cannot be modified directly**. - You can: - **Add new values** - **Delete existing values** This guarantees referential integrity for any rooms already using this attribute. After adding or removing values, click **Save** to apply the changes. ### Deleting a room attribute You can permanently delete a room attribute when it is no longer needed. To delete an attribute: 1. Locate the attribute you want to modify. 2. Click the kebab menu **(⋮)** at the end of the row and select **Delete**. A confirmation dialog appears asking you to confirm the action. > [!WARNING] > Important behaviour: > > - If the attribute is **not assigned to any rooms**, it can be deleted safely with **no impact on existing rooms**. > - If the attribute **is assigned to one or more rooms**, deletion is blocked and you must first remove it from all rooms before it can be deleted. > - Deletion is **permanent** and cannot be undone. ### Searching for attributes At the top of the Room Attributes tab, use the **Search attributes** field to quickly locate an attribute. The search works across: - Attribute names - Attribute values This allows you to find attributes even when you only remember one of their values. > [!WARNING] > In an ABAC-managed room, the **Topic**, **Announcement**, and **Description** fields are disabled in the room information edit view. To change these values, remove the ABAC attributes from the room first. --- ## Manage ABAC rooms The **Rooms** tab is where administrators bring private rooms under Attribute-Based Access Control (ABAC) enforcement. Once a room is ABAC-managed, its membership is controlled strictly by user attributes synchronized from LDAP. Manual room management is restricted, and access is enforced automatically and continuously. From this view, you can: - Search and filter ABAC-managed rooms - Add new rooms to ABAC control - Assign required access attributes and values - View real-time membership counts - Remove rooms from ABAC enforcement ### Understanding the rooms list Each row in the Rooms table represents one ABAC-managed room and displays the following information: - **Room**: The name of the channel or team under ABAC control - **Members**: The number of users who currently satisfy the ABAC rules - **Subject attributes**: The attribute used to control access - **Attribute values**: The values required for access - **Actions menu (⋮)**: Used to manage or remove the room from ABAC Only **private channels and private teams** appear here. Public rooms cannot be managed by ABAC. ### Searching and filtering rooms At the top of the page, the search bar allows you to find rooms using multiple criteria. You can search by: - Room name - Attribute name - Attribute value Next to the search bar, a filter dropdown lets you scope your search to: - **All**: Searches across rooms, attributes, and values - **Rooms**: Searches only by room name - **Attributes**: Searches only by attribute name - **Values**: Searches only by attribute values This makes it easy to locate ABAC-managed rooms even in large environments. ### Adding a room to ABAC To begin enforcing ABAC on a room, click **Add Room**. #### Step 1: Select the room In **Room to be ABAC-managed**, select a private channel or private team. Important behavior: - This list only shows **eligible rooms** - A room appears here **only if**: - It is private - It is not already ABAC-managed - It still uses default access control If this field shows **“Empty”**, it means no rooms currently meet these conditions. In that case, create a new private room first. #### Step 2: Assign required attributes After selecting a room: 1. Choose an **Attribute** from the dropdown 2. Select one or more **Attribute Values** 3. Click **Add Attribute** to attach the rule 4. Repeat as needed to add additional required attributes Each attribute added acts as a **mandatory access condition**. A user must match **all configured attributes and values** to remain a member of the room. #### Step 3: Finalize the configuration Once all required attributes are assigned, save the configuration. The room immediately becomes ABAC-managed, and enforcement begins. Membership is evaluated automatically: - Users who match the rules remain or are added - Users who do not match the rules are removed within seconds ### How enforcement works for ABAC rooms Once a room is under ABAC control: - Users are **automatically added and removed** based on LDAP attributes - Administrators **cannot manually add users** unless they already satisfy all attribute rules - Membership is **continuously re-evaluated** on: - LDAP syncs - Room attribute changes - ABAC reactivation This guarantees Zero-Trust enforcement where access is always attribute-driven. ### Editing an ABAC-managed room To modify an existing ABAC rule for a room, open the kebab menu **(⋮)** on the right side of the room row and select **Edit**. The **Edit Room** dialog allows you to: - View the currently managed room - Change the **attribute** - Modify the **allowed attribute values** - Add additional attributes - Remove existing attributes > [!WARNING] > The room itself cannot be changed during editing, only its enforcement rules. Changes take effect immediately after clicking **Save**, and user membership is re-evaluated automatically. ### Removing a room from ABAC management To stop enforcing ABAC on a room, open the kebab menu **(⋮)** and select **Remove**. A confirmation dialog appears with the following message: `Removing this room from ABAC management may result in unintended users gaining access.` This warning exists because: - Once ABAC enforcement is removed, the room reverts to standard Rocket.Chat access control - Users who do not meet the former ABAC conditions may retain access Click **Remove** to proceed, or **Cancel** to keep the room under ABAC control. ### Converting an ABAC-managed room to public ABAC applies only to private rooms. If you convert a private room that was previously ABAC-managed to a public channel, its ABAC attributes are removed during the conversion. Switching the room back to private does not restore them, you must re-assign the attributes at **Manage → Workspace → Attribute Based Access Control → Rooms**. --- ## ABAC logs and audit trail The **Logs** tab provides a complete audit trail of all ABAC-related activity across the workspace. This audit log is designed for security monitoring, compliance verification, and operational troubleshooting, ensuring that every change to ABAC configuration is fully traceable. Administrators use this view to answer critical questions such as: - Who created or modified an attribute? - When was a room placed under ABAC enforcement? - Which user removed an attribute or updated a room’s access policy? All actions recorded here are generated automatically by Rocket.Chat and cannot be altered. ### Understanding log entries Each log entry contains the following fields: - **User**: The account that performed the action. System-initiated events (such as automatic evaluations) appear as **System**. - **Action**: What happened (for example, *Created*, *Updated*, or *Removed*). - **ABAC Element**: The object affected by the change (such as *Room, Room Attribute*). - **Element Name**: The exact name of the room or attribute involved. - **Timestamp**: The precise date and time when the action occurred. This structure allows administrators to reconstruct a complete change history of ABAC enforcement across the workspace. ### Time-based filtering The Logs view supports full **date-range filtering** and **quick time presets** to make investigations faster. You can filter by: - Today - Yesterday - This Week - Previous Week - This Month - All time You can also manually select a custom start date and end date using the date pickers at the top of the page. This is especially useful during incident response, audits, or access reviews. > [!WARNING] > For App developers > > Apps built on the Apps Engine can read a room's ABAC attributes by declaring the `abac.read` permission in their `app.json` manifest. See the [App Permission System](https://developer.rocket.chat/docs/app-permission-system) page for the full list of app permissions and how to add them.