Directus Basics Part 3 — User Roles & Permissions

This is part three of our Directus Basics series. In part one we set up our instance, and in part two we covered relationships between collections. Today we're covering access control — what determines who can see and touch your data. The Core Concepts Access control in Directus comes down to three terms: Permission — applies to one collection and one action (create, read, update, delete, or share). Can be full access, no access, or custom rules. Policy — a group of permissions bundled together, applied to users or roles. Role — defines a user's position within a project. A role can hold any number of policies, apply to any number of users, and have child roles of its own. What Happens Without a Role? If an administrator creates a user but doesn't assign a role, that user has valid login credentials but still can't access the Data Studio. Creating a role and assigning the user to it isn't enough either — logging in at that point returns a "No App Access" error. The missing piece is that the role has no access policy attached. The policy is what actually tells the role what its users can and can't do. The Access Order Access in Directus flows in a specific direction: Access Policy → Role → User In practice: define what level of access a user needs, build an access policy to match, create a role and attach that policy to it, then register the user and assign them to the role. Default Policies Every fresh Directus instance ships with two default policies: Administrator — the role you're signed in as by default, with unrestricted access to everything. Public — for data that should be visible without logging in. Think of a product catalog on an e-commerce site — forcing a login just to browse products is a poor experience. Rule of thumb: give the Public policy Read access only. Never Create, Update, or Delete. The public should be able to view data, never manipulate it. Giving a Collection Public Access Go to Settings → Access Policies → Public Under Permissions, click A