---
title: "How do I create a policy to control access to workspaces?"
slug: "how-do-i-create-a-policy-to-control-access-to-workspaces"
updated: 2026-01-27T16:18:05Z
published: 2026-01-27T16:18:05Z
canonical: "support.lusid.com/how-do-i-create-a-policy-to-control-access-to-workspaces"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How do I create a policy to control access to workspaces?

Providing you are a LUSID user with sufficient privileges, you can create a [policy](/v1/docs/what-are-a-policy-and-a-policy-collection) to grant or restrict access to one or more [workspaces](/v1/docs/workspaces-and-dashboard-sets) in LUSID.

> **Note:** If you are the LUSID domain owner, you are automatically assigned the built-in `lusid-administrator` role, which has all the permissions necessary to perform the operations in this article.

Once created, you should assign the policy to a [role](/v1/docs/what-is-a-role).

## Administrative access to workspaces

To create a policy that grants access to create, edit, and delete a workspace, and create and delete items *within* that workspace:

1. Navigate to **Identity and Access > Policies** and click the **Create policy** button. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(190).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A13Z&se=2026-11-04T03%3A54%3A13Z&sr=c&sp=r&sig=tBqCefzPOcpxHhRllkjZdonEOKmidz6dyeenzJq3JKw%3D)
2. Specify the following:
  - A unique **Policy code**
  - A friendly **Description** for the policy
  - Whether this policy will **Allow** or **Deny** access to the specified features and data
3. Go to the **Data Resources** tab, locate **LUSID** > **Workspace** and select **Any**. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image-CEZF4NNG.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A13Z&se=2026-11-04T03%3A54%3A13Z&sr=c&sp=r&sig=tBqCefzPOcpxHhRllkjZdonEOKmidz6dyeenzJq3JKw%3D)
4. **Save** your policy.
5. Assign the policy to a [role](/v1/docs/what-is-a-role).
6. [Assign the role to the user](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api) you want to grant administrative workspace access to.

## Read-only access to workspaces

To create a policy that grants read-only access to a workspace:

1. Navigate to **Identity and Access > Policies** and click the **Create policy** button. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(190).png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A13Z&se=2026-11-04T03%3A54%3A13Z&sr=c&sp=r&sig=tBqCefzPOcpxHhRllkjZdonEOKmidz6dyeenzJq3JKw%3D)
2. Specify the following:
  - A unique **Policy code**
  - A friendly **Description** for the policy
  - Whether this policy should **Allow** or **Deny** access to the specified features and data
3. Go to the **Data Resources** tab and locate **LUSID** > **Workspace**. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image-XXWLH9TB.png?sv=2026-02-06&spr=https&st=2026-11-04T02%3A54%3A13Z&se=2026-11-04T03%3A54%3A13Z&sr=c&sp=r&sig=tBqCefzPOcpxHhRllkjZdonEOKmidz6dyeenzJq3JKw%3D)
4. Select the **Read** and **ReadItem** actions and specify the following for each workspace you want to control access to:

> [!NOTE]
> Note
> 
> It’s important you select both the **Read** and **ReadItem** actions. The **Read** action controls access to see the workspace, while the **ReadItem** action controls access to see items *within* the workspace, including dashboards and dashboard sets.
  - **Selector**: `Identifier`
  - **Visibility**: `shared`
  - **Name**: The name of the workspace
5. **Save** your policy.
6. Assign the policy to a [role](/v1/docs/what-is-a-role).
7. [Assign the role to the user](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api) you wish to grant read-only workspace access to.

> [!NOTE]
> Note
> 
> - Workspace permissions govern access to everything within a workspace, including the dashboards and data they display (**ReadItem** activity).
> - You may only grant **ReadItem** access for an entire workspace; you cannot restrict access to particular items within a workspace.
> - If a dashboard set references a dashboard in another workspace, users must have read access to both workspaces.
> 
> [Read more on workspaces and dashboard sets.](/v1/docs/workspaces-and-dashboard-sets)