Session attributes docs

source/administration-guide/configure/system-attributes.rst

@@ -12,4 +12,5 @@ You can define, manage, and enforce specific attributes, including:
 
 - **User attributes**: Display details such as job titles, departments, or other metadata, on user profiles that align with your organizational structures and workflows. Learn more about :doc:`managing user attributes </administration-guide/manage/admin/user-attributes>`. API responses for user attributes return default visibility and sort order when those values are missing.
 - **Granular access controls based on user attributes**: Ensure users have access to only the resources and functionality relevant to their roles, bolstering security and compliance across the organization. Learn more about :doc:`managing access based on user attributes </administration-guide/manage/admin/attribute-based-access-control>`.
+- **Session attributes**: From Mattermost v11.11 (Enterprise Advanced), evaluate per-session device and network context - such as IP address, network interface type, VPN status, and MDM enrollment - in permission policies. Learn more about :doc:`managing session attributes </administration-guide/manage/admin/session-attributes>`.
 - **Control user-managed attributes in attribute-based access control (ABAC)**: From Mattermost v10.11 (Enterprise Edition Advanced), user-managed attributes are excluded from ABAC rules by default to prevent unauthorized access. System admins can enable them with a configuration setting. Learn more about enabling user-managed attributes in ABAC rules in the :ref:`User Attributes documentation <administration-guide/manage/admin/user-attributes:before you begin>`.

source/administration-guide/manage/admin/abac-channel-access-rules.rst

@@ -38,6 +38,10 @@ Access Channel Settings
 
   You can also assign ABAC rules to a channel directly from a channel's details page in the System Console under **Channel Management** by enabling the **Enable attribute-based channel access** option. Under **Access policy**, select **Link to a policy** to select an existing policy.
 
+.. important::
+
+  **Changes aren't applied until you save the tab.** Editing rules in either the **Membership Policy** or **Permissions Policy** tab stages your changes locally - nothing reaches the channel until you select **Save** in the **Save Changes** panel at the bottom of the tab. Permission rules take one more step than membership rules: selecting **Add rule** or **Save rule** in the rule editor only commits the rule to the list, and you still need to save the tab afterwards.
+
 Configure access rules
 ----------------------
 
@@ -126,13 +130,24 @@ From Mattermost v11.8.0, channel admins can define channel-level permission rule
 
 For system-wide permission policies that restrict file upload and download actions, see :ref:`Permission policies <administration-guide/manage/admin/abac-system-wide-policies:permission policies>`.
 
+From Mattermost v11.11, permission rules can also use any :doc:`session attributes </administration-guide/manage/admin/session-attributes>` a System Admin has enabled, letting you restrict file actions by device or network rather than by who the user is.
+
+.. warning::
+
+  A rule that references a session attribute denies any session that doesn't have it. The server measures ``ip_address`` and the ``user_agent_*`` values from every request, but device attributes such as ``os_platform`` and ``vpn_active`` are reported only by the Desktop and mobile apps, so a rule using one of those denies everyone working in a web browser. Review :ref:`platform availability <administration-guide/manage/admin/session-attributes:platform availability>` and simulate the rule before saving it.
+
 Simulate access
 ----------------
 
 From Mattermost v11.8.0, admins can use **Simulate access** in Channel Settings to preview whether selected users can perform actions such as uploading files or downloading files before saving policy changes.
 
 - Simulation can evaluate draft rules before they're saved, so you can confirm the intended scope without affecting live channel access.
 - Some denied results may indicate that the decision came from another policy. In that case, Mattermost shows that access was denied by another policy without exposing policy details you aren't authorized to see.
+- From Mattermost v11.11, a neutral **No recent session** result indicates that the rules reference :doc:`session attributes </administration-guide/manage/admin/session-attributes>` and the selected user has no cached session data to evaluate.
+
+.. note::
+
+  Detailed evaluation traces showing how each rule contributed to a decision are only available to System Admins. Channel Admins and Team Admins see the contributing rule expressions without the underlying trace.
 
 .. note::
 

source/administration-guide/manage/admin/abac-system-wide-policies.rst

@@ -14,6 +14,8 @@ Prerequisites
 
 From Mattermost v10.11, user-managed attributes are excluded from attribute-based access control (ABAC) rules by default for security reasons. This prevents access control policies from being circumvented by users editing their own profile attributes. To include user-managed attributes in ABAC rules, a system admin must explicitly enable the ``EnableUserManagedAttributes`` configuration setting. See the :ref:`user attribute <administration-guide/manage/admin/user-attributes:before you begin>` documentation for details on enabling this feature. This configuration setting is available only in Enterprise Edition Advanced and is disabled by default.
 
+From Mattermost v11.11, :doc:`session attributes </administration-guide/manage/admin/session-attributes>` describing the connection a user is on - such as their IP address, VPN status, and device posture - can be used in `permission policies`_. Each session attribute must be enabled in **System Console > System Attributes > Session Attributes** before a rule can reference it.
+
 Define access control policies
 ------------------------------
 
@@ -85,6 +87,8 @@ From Mattermost v11.8.0, you can use **Simulate access** to preview allowed and
 
 Simulation can test draft policy changes before they affect live channel access or file permissions. Detailed rule and attribute information is shown only when the denial comes from the policy or scope you're editing; otherwise, Mattermost may show that access was denied by another policy.
 
+From Mattermost v11.11, results can also show a neutral **No recent session** indicator. This appears when the contributing rules reference :doc:`session attributes </administration-guide/manage/admin/session-attributes>` (``user.session.*``) and the selected user has no cached session attributes to evaluate - usually because they haven't connected recently, or haven't connected from a client that reports those attributes.
+
 .. note::
 
   **Simulate access** and channel-level permission policies for file upload and file download are gated by the ``PermissionPolicies`` feature flag (``MM_FEATUREFLAGS_PERMISSIONPOLICIES``) and require a Mattermost Enterprise Advanced license. See the Mattermost developer documentation for details on `enabling feature flags in a self-hosted deployment <https://developers.mattermost.com/contribute/more-info/server/feature-flags/#self-hosted-and-local-development>`_. Mattermost Cloud customers can request this feature flag be enabled by contacting their Mattermost Account Manager or by `creating a support ticket <https://support.mattermost.com/hc/en-us/requests/new?ticket_form_id=11184911962004>`_.
@@ -142,7 +146,7 @@ You can assign an existing access control policy to a private or public channel
 2. In the **Channel Management** section, enable the **Enable attribute-based channel access** option.
 3. Under **Access policy**, select **Link to a policy** to select an existing policy.
 
-Once a policy is attached, the channel's privacy can no longer be flipped between public and private until the policy is removed — see :ref:`Channel-specific access rules <administration-guide/manage/admin/abac-channel-access-rules:validation-and-safety>`.
+Once a policy is attached, the channel's privacy can no longer be flipped between public and private until the policy is removed — see :ref:`Channel-specific access rules <administration-guide/manage/admin/abac-channel-access-rules:validation and safety>`.
 
 .. tip::
 
@@ -167,6 +171,8 @@ When a permission policy applies, users who don't match the configured attribute
 
 Permission policies follow the same unique-name requirement as access policies: each parent permission policy must have a unique name, and Mattermost surfaces a user-friendly error if a duplicate name is entered.
 
+From Mattermost v11.11, permission policy rules can also evaluate :doc:`session attributes </administration-guide/manage/admin/session-attributes>` - for example, restricting file downloads to devices on a corporate IP range or to MDM-enrolled devices. Because a rule that references a session attribute denies any session that doesn't report it, review the platform availability of each attribute before applying it to a file action your users depend on. Client-reported attributes such as ``mdm_enrolled`` are self-attested posture signals rather than proof; for stronger assurance, gate on server-measured values instead - ``ip_address`` with an IP range check, or ``tls_device_id`` asserted by your reverse proxy.
+
 Attribute value masking
 -----------------------
 

source/administration-guide/manage/admin/attribute-based-access-control.rst

@@ -13,6 +13,7 @@ Attribute-Based Access Control
   /administration-guide/manage/admin/abac-team-membership
   /administration-guide/manage/admin/abac-team-channel-policies
   /administration-guide/manage/admin/abac-channel-access-rules
+  /administration-guide/manage/admin/session-attributes
 
 From Mattermost v10.9, system admins in large or complex organizations who require Zero Trust Security when handling with sensitive information can prevent unauthorized access through attribute-based access controls.
 
@@ -46,6 +47,8 @@ Once user attributes are defined, go to **System Console > System Attributes > A
 
 From Mattermost v10.11, user-managed attributes are excluded from attribute-based access control (ABAC) rules by default for security reasons. This prevents access control policies from being circumvented by users editing their own profile attributes. To include user-managed attributes in ABAC rules, a system admin must explicitly enable the ``EnableUserManagedAttributes`` configuration setting. See the :ref:`user attribute <administration-guide/manage/admin/user-attributes:before you begin>` documentation for details on enabling this feature. This configuration setting is available only in Enterprise Edition Advanced and is disabled by default.
 
+From Mattermost v11.11, permission policies can also evaluate :doc:`session attributes </administration-guide/manage/admin/session-attributes>` - per-session context such as the client's IP address, network interface type, VPN status, and device posture - alongside user attributes. Each session attribute must be enabled in **System Console > System Attributes > Session Attributes** before a rule can reference it.
+
 Configure access policies
 --------------------------
 

source/administration-guide/manage/admin/server-configuration.rst

@@ -18,6 +18,7 @@ Whether you’re setting up email notifications, optimizing search capabilities,
     Install Mattermost Boards </administration-guide/configure/install-boards>
     Install and manage plugins </administration-guide/configure/manage-plugins>
     Manage user attributes </administration-guide/manage/admin/user-attributes>
+    Manage session attributes </administration-guide/manage/admin/session-attributes>
     Enable content flagging </administration-guide/manage/admin/content-flagging>
     Environment variables </administration-guide/configure/environment-variables>
     Customize the server </administration-guide/manage/admin/customize-branding>
@@ -37,6 +38,7 @@ Whether you’re setting up email notifications, optimizing search capabilities,
 * :doc:`Install Mattermost Boards </administration-guide/configure/install-boards>` - Learn how to install and configure the Boards plugin for your Mattermost instance.
 * :doc:`Install and manage plugins </administration-guide/configure/manage-plugins>` - Learn how to install, enable, configure, update, and remove plugins for your Mattermost instance.
 * :doc:`Manage custom user attributes </administration-guide/manage/admin/user-attributes>` - Learn how to manage custom user attributes in user profiles in Mattermost.
+* :doc:`Manage session attributes </administration-guide/manage/admin/session-attributes>` - Learn how to collect and use per-session device and network context in access control policies.
 * :doc:`Environment variables </administration-guide/configure/environment-variables>` - Learn how to use environment variables for Mattermost configuration.
 * :doc:`Customize the server </administration-guide/manage/admin/customize-branding>` - Learn about customizing branding for Mattermost server.
 * :doc:`SMTP email setup </administration-guide/configure/smtp-email>` - Learn how to set up SMTP email for Mattermost.