Add, remove and set page restrictions using a workflow trigger

1 Overview | 2 Add a restriction | 3 Remove a restriction | 4 Remove then Add restrictions → Set restrictions | 5 Blocking changes to content

Overview

These examples summarise the macros you can use to change page restrictions.

These macros are used as part of a workflow trigger to set the content permission for the specified users and change the capability of these listed users.

The Confluence user(s) or a user who is a member of a Confluence group listed in the macro will have the type of permission (view, or edit) specified in the macro.

Other users who are not listed in the macro will have their permission for the content restricted.

Add a restriction

In this example, when the workflow transitions to the Review state, we use the add-restriction macro to restrict editing to the document creator and members of the reviewers group:

{workflow:name=Edit restrictions}
   {state:Editing|submit=Review}
   {state}
   {state:Review}
   {state}
   {trigger:statechanged|state=Review}
      {add-restriction:type=edit|user=@creator@|group=reviewers}
   {trigger}
{workflow}

Action	Type	user / group	Result

Action	Type	user / group	Result
`add-restriction`	view	@creator@	only creator can see the content no other users will be able to access the content
`add-restriction`	edit	reviewers	only users who are members of the Confluence reviewers group will be able to edit the page all other users will have view permission (unless separately restricted)

Remove a restriction

In this example, we use the remove-restriction macro to remove the page restrictions if the content review is approved.

{workflow:name=Edit restrictions}
   {state:Editing|submit=Review}
   {state}
   {state:Review|approved=Published|rejected=Editing}
      {approval:Review}
   {state}
   {state:Published}
   {state}
   {trigger:statechanged|state=Review}
      {add-restriction:type=edit|user=@creator@|group=reviewers}
   {trigger}
   {trigger:pageapproved|approval=Review}
      {remove-restriction:type=edit|user=@creator@|group=reviewers}
   {trigger}
{workflow}

Using remove-restriction will simply remove the specified permission type for the named user(s) on the content.

If you want to remove all added permissions of a specific type simply do not include users or groups in the remove-restriction macro.

For example, when the following two macros are used together in a trigger, one will remove all added edit permission restrictions, the other will remove all added view permission restrictions.

{remove-restriction:type=edit}
{remove-restriction:type=view}

You must include a separate macro for each type of permission.

The macro will not remove any page-level restrictions or other permissions that have been previously added.

Remove then Add restrictions → Set restrictions

If you remove restrictions of a certain type, then add restrictions of the same type, it can cause errors. This is due to the way Confluence works internally (database connections, long-running threads... reasons).

To avoid this possible issue, it's sometimes safer to use the set-restrictions macro when you need to remove, then add, restrictions of the same type.

In the example below

when the state changes to Review, only the content creator (Matilde Sipes in the example) and users who are members of the Confluence user group reviewers are able to edit the content
when the review is approved, using set-restrictions in a trigger on the pageapproved event we clear all existing edit restrictions and then only allow users who are members of the Confluence user group maintenance to edit the published content