Permissions and roles

BookStack uses roles to decide what a user can see and change. Books, chapters and pages can also have content-specific permissions. A user's effective access depends on both, so test with a representative account after changing permissions.

A practical starting point

• Administrator: manages settings, users and permissions. Give this role only to people who need it.
• Editor: writes and maintains content in the areas assigned to them.
• Viewer: reads the knowledge needed for their work.
• Public: represents visitors who are not signed in when public viewing is enabled.

This demo's rules

All non-admin roles in this demo have reading and export permissions only. Public viewing is enabled and registration is disabled. Visitors cannot create pages, edit this guide or use document intake to publish here. Your private workspace needs its own access decisions; these demo settings are not a recommendation to publish internal knowledge.

Before making a book public

Review every page for employee details, customer data, credentials and private links. Check child pages and attachments as well as the book description. Open the book in a signed-out browser to verify the result.

Review access regularly

Remove access when a teammate leaves or changes responsibility. Avoid shared administrator accounts. When a page unexpectedly disappears for a user, investigate role membership and inherited permissions before granting broad access.

Owner: Workspace administrator. Record permission changes in a private administration book.