# How to manage user roles in Bubble

- Tool: Bubble
- Difficulty: Beginner
- Time required: 15-20 min
- Compatibility: All Bubble plans
- Last updated: March 2026

## TL;DR

Manage user roles in Bubble by adding a 'role' field (text or Option Set) to the User data type. Assign roles during registration or via admin panel. Gate pages, elements, and workflow actions using conditions that check Current User's role. Combine with Privacy Rules to control database access per role. Common roles include admin, editor, viewer, and custom roles specific to your app.

## Manage User Roles and Permissions in Bubble

This tutorial covers implementing role-based access control (RBAC) in Bubble for controlling what different users can see and do.

## Before you start

- A Bubble account with user authentication
- Basic understanding of Privacy Rules
- Familiarity with conditional visibility

## Step-by-step guide

### 1. Define Roles on the User Data Type

Go to Data tab → User. Add a field 'role' — use an Option Set type (recommended) or text. Create an Option Set 'UserRole' with options: Admin, Editor, Viewer, Member. Set the default value to 'Member' for new signups.

**Expected result:** User data type has a role field with defined options.

### 2. Assign Roles During Registration and via Admin

In the signup workflow, after creating the user, set role = 'Member'. Build an admin page with a Users Repeating Group. Add a Dropdown per user row to change their role. Workflow: Make changes to displayed User → role = Dropdown value. Only admins can access this page.

**Expected result:** New users get a default role, and admins can change roles.

### 3. Gate Pages by Role

On admin-only pages, add a Page is loaded workflow: Only when Current User's role is not 'Admin' → Go to page 'unauthorized' or 'home'. For editor pages: Only when Current User's role is not 'Admin' AND is not 'Editor' → redirect. This prevents unauthorized access.

**Expected result:** Users are redirected from pages they do not have access to.

### 4. Control Element Visibility by Role

On the Conditional tab of elements: When Current User's role is 'Admin' → visible. For edit buttons: visible when role is Admin or Editor. For delete buttons: visible only when Admin. Always apply conditions to container Groups rather than individual elements.

**Expected result:** UI adapts to show only role-appropriate features.

### 5. Set Privacy Rules by Role

Go to Data tab → Privacy. Create rules: 'When Current User's role is Admin' → all permissions. 'When Current User's role is Editor' → Find, View, and Modify own records. 'When Current User's role is Viewer' → Find and View only. This enforces data access at the database level.

**Expected result:** Database access is restricted based on user roles.

## Complete code example

File: `Workflow summary`

```text
OPTION SET: UserRole
- Admin: full access to everything
- Editor: create/edit content, view all
- Viewer: view only, no editing
- Member: basic access, own data only

USER DATA TYPE:
- role (UserRole, default: Member)

PAGE ACCESS CONTROL:
- Admin pages: redirect if role ≠ Admin
- Editor pages: redirect if role ≠ Admin AND ≠ Editor
- Member pages: redirect if not logged in

ELEMENT VISIBILITY:
- Admin panel: visible when role = Admin
- Edit buttons: visible when role = Admin OR Editor
- Delete buttons: visible when role = Admin only
- View content: visible for all logged-in users

PRIVACY RULES:
- Content type:
  Rule 1: Current User's role is Admin → all permissions
  Rule 2: Current User's role is Editor → Find, View, Modify
  Rule 3: Current User's role is Viewer OR Member → Find, View only
  Rule 4: This Content's author is Current User → all permissions

ADMIN PAGE:
- RG Users: name, email, role dropdown, Save button
- Only accessible by Admin role
```

## Common mistakes

- **Using text field instead of Option Set for roles** — Text fields allow typos and inconsistent values ('admin' vs 'Admin' vs 'ADMIN'). Fix: Use an Option Set for roles to enforce consistent values.
- **Relying solely on element visibility for security** — Hiding a delete button does not prevent API access. Tech-savvy users can still trigger actions. Fix: Combine visibility conditions with Privacy Rules and workflow-level 'Only when' conditions.
- **Not setting a default role on signup** — New users without a role bypass role-based conditions, potentially accessing admin features. Fix: Always set a default role (e.g., Member) in the signup workflow.

## Best practices

- Use Option Sets for role definitions to prevent inconsistency.
- Set a default role on every new user during registration.
- Combine page-level redirects, element visibility, and Privacy Rules for defense in depth.
- Gate pages in the Page is loaded workflow — do not rely only on hidden navigation links.
- Apply conditions to Groups rather than individual elements.
- Log role changes for audit trails.

## Frequently asked questions

### Can a user have multiple roles?

Yes. Change the role field to a list of UserRole. Check conditions with 'contains' instead of 'is'. This allows combinations like Editor + Moderator.

### How do I add a Super Admin role?

Add a 'Super Admin' option to your UserRole Option Set. Super Admins can manage other admins. Add appropriate conditions.

### Can I create dynamic roles per project or team?

Yes. Create a TeamMembership data type with user, team, and role fields. Check the user's role within the context of the current team or project.

### How do I prevent users from changing their own role?

In Privacy Rules, remove Modify permission for the role field except for Admin users. Also add 'Only when Current User's role is Admin' on the role change workflow.

### Should I use Bubble's built-in admin feature?

Bubble does not have a built-in RBAC system — you must build it yourself. For complex permission systems, RapidDev can architect scalable role-based access control for your app.

### How do I handle role inheritance (admin includes editor permissions)?

In conditions, check for multiple roles: 'Only when Current User's role is Admin OR Editor'. Or create a hierarchy number on the Option Set and check 'role's hierarchy >= required level'.

---

Source: https://www.rapidevelopers.com/bubble-tutorial/limit-and-manage-user-roles-in-bubble
© RapidDev — https://www.rapidevelopers.com/bubble-tutorial/limit-and-manage-user-roles-in-bubble