Using negative permissions, this role prevents a user's ability to create & delete a workspace within a given organization.

Workspaces are uniquely owned by an org and a user, so the org has to supercede the user permission with a negative permission.

Use case

Organizations must be able to restrict a member's ability to create a workspace. This permission is implicitly granted (see#16546 (comment)).

To revoke this permission, the solution chosen was to use negative permissions in a built in role calledWorkspaceCreationBan.

Rational

Using negative permissions is new territory, and not ideal. However, workspaces are in a unique position.

Workspaces have 2 owners. The organization and the user. To prevent users from creating a workspace in another organization, animplied negative permission is used. So the truth table looks like:how to read this tablehere

This new role,WorkspaceCreationBan is the same truth table condition as if the user was not a member of the organization (when doing a workspace create/delete). So this behavioris not entirely new.

Will we need more negative built in roles?

There are few resources that have shared ownership. OnlyResourceOrganizationMember andResourceGroupMember. Since negative permissions is intended to revoke access to a shared resource, thenno.This is the only one we need.

Classic resources likeResourceTemplate are entirely controlled by the Organization permissions. And resources entirely in the user control (like user profile) are only controlled byUser permissions.