Is `can_manage` required for workspace-gated creation intentional? (before_request.py:520)

[wbsong111]

Environment

• mlflow-oidc-auth: v7.0.3
• MLflow: 3.11.1
• MLFLOW_ENABLE_WORKSPACES: "true"
• OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT"

---

Observed Behavior

When workspaces are enabled, CreateExperiment and CreateRegisteredModel inside a
workspace return 403 Permission denied for users with EDIT permission.

hooks/before_request.py line 520:

ws_perm = get_workspace_permission_cached(username, workspace)
if ws_perm is None or not ws_perm.can_manage:   # requires MANAGE
    return responses.make_forbidden_response()

EDIT users have can_update=True but can_manage=False, so they are always rejected
when X-MLflow-Workspace header is present.

---

Question

Is this intentional?

Interpretation A — Bug: EDIT should be sufficient to create experiments within a
workspace (consistent with all other create/update handlers in the same file).

CreateLoggedModel:           validate_can_update_experiment   # EDIT
CreatePromptOptimizationJob: validate_can_update_experiment   # EDIT

If so, the fix would be:

if ws_perm is None or not ws_perm.can_update:   # EDIT is sufficient
    return responses.make_forbidden_response()

Interpretation B — Intentional: Creating a new experiment is considered a
workspace-structural change, requiring MANAGE. EDIT users can only add runs/metrics
to existing experiments.

If this is the intended design, is it documented somewhere? We couldn't find any
mention of this restriction in the README or configuration reference, and
OIDC_WORKSPACE_DEFAULT_PERMISSION: "EDIT" does not make this behavior obvious.

[kharkevich]

hi @wbsong111, this is expected behaviour, thank for highlighting lack in documentation, it was updated in #245