# Permission Matrix block

> Workspace roles and permissions access matrix with locked Owner column and grouped scope toggles

Full-page matrix mapping workspace roles to grouped permission scopes: per-cell toggles, locked Owner access, group tabs, and a dirty save bar. ReUI DataGrid, Frame, Badge, Alert; shadcn Button, Tabs, Dialog. Admin panel, role management, RBAC.

- Type: Pro block
- Category: [Users](https://web.dev.reui.io/blocks/solutions/users.md)
- Page: https://web.dev.reui.io/blocks/solutions/users/solution-users-3
- MCP: `get_block("solution-users-3")`
- Built with: Alert, Badge, Button, Data Grid, Dialog, Dropdown Menu, Field, Frame, Input Group, Separator, Switch, Tabs, Textarea
- Installs with a ReUI Pro or Ultimate license; setup: https://web.dev.reui.io/docs/license-setup

## Best for

Switches for 6 roles across 8 permission groups, a locked Owner column, grant counts per role and a new role dialog

## Agent notes

- `WORKSPACE_ROLES` and `PERMISSION_ROWS` are the sample roles and scope rows; the locked Owner column comes from `locked` on the owner role
- `handleSave` only clears `dirty` and toasts, and `handleCreateRole` closes the dialog and toasts without adding a role column
- `readOnly` is a local button toggle that simulates a viewer without edit rights; drive it from your real permission check

## When not to use

- Editing the capabilities of one role as a short list of toggles: use [Role Capabilities](https://web.dev.reui.io/blocks/application/settings/settings-5.md) (`get_block("settings-5")`)
- Access granted per member, one row each, with scope switches that change by tab: use [Access Permissions Matrix](https://web.dev.reui.io/blocks/data-grid/columns/data-grid-columns-1.md) (`get_block("data-grid-columns-1")`)

## Third-party libraries

- TanStack Table v9: [API reference](https://tanstack.com/table/v9/docs/framework/react/reference/index), [docs](https://tanstack.com/table/v9/docs/framework/react/quick-start)
- Sonner v2: [API reference](https://sonner.emilkowal.ski/toast), [docs](https://sonner.emilkowal.ski/getting-started)

## Install

```bash
npx shadcn@latest add @reui/solution-users-3
```

## About Users blocks

### When to use

- Workspace admin pages for people: a members directory, one member's record and the invitations queue
- Access control work: a role by permission matrix, just in time access requests and a day grouped audit log
- Enterprise sign-in settings for SSO providers, SCIM provisioning, 2FA, session limits and email domains

### When not to use

- A person editing their own account: avatar, name, email, password and notification choices: use the [Profile blocks](https://web.dev.reui.io/blocks/application/profile.md)
- A table section of your own records, with no roles, sign-in methods or invites around it: use the [Base blocks](https://web.dev.reui.io/blocks/data-grid/base.md)
- Notification, appearance or integration options, with no people or SSO to manage: use the [Settings blocks](https://web.dev.reui.io/blocks/application/settings.md)

### Agent notes

- Every page.tsx sets a padded `min-h-svh` wrapper, and page.tsx or the root caps the max width; drop both inside your app shell
- Feedback goes through sonner `toast` and no block mounts a Toaster, so render one in your layout or no message appears
- No block sends a request or writes storage: state sits in `useState` or uncontrolled inputs, so every change resets on reload

Every ReUI item has a twin like this one; the index is https://web.dev.reui.io/llms.txt. Agents with the ReUI MCP (https://web.dev.reui.io/docs/mcp) get the same guidance from the getters named above.