---
title: Technical Advisory 10007
description: "A-10007: Upcoming ZITADEL versions apply RBAC to system users with new SYSTEM_OWNER role affecting custom permission mappings"
---

## Date and Version

Version: Upcoming

Date: Upcoming

## Affected Users

This advisory applies to self-hosted ZITADEL installations with custom roles to permissions mappings in the *InternalAuthZ.RolePermissionMappings* configuration section.

## Description

In upcoming ZITADEL versions, RBAC also applies to [system users defined in the ZITADEL runtime configuration](/guides/integrate/zitadel-apis/access-zitadel-system-api#runtime-settings).
This enables fine-grained access control to the system API as well as other APIs for system users.
ZITADEL defines the new default roles *SYSTEM_OWNER* and *SYSTEM_OWNER_VIEWER*.
System users without any memberships defined in the configuration will be assigned the *SYSTEM_OWNER* role.
**Self-hosting users who define their own custom mapping at the *InternalAuthZ.RolePermissionMappings* configuration section**, have to define the *SYSTEM_OWNER* role in their configuration too to be able to access the system API with the default system user membership.

## Statement

This change is tracked in the following PR: [feat: add SYSTEM_OWNER role](https://github.com/zitadel/zitadel/pull/6765).
As soon as the release version is published, we will include the version here.

## Mitigation

If you have a custom role mapping configured, make sure you configure the new role *SYSTEM_OWNER* before migrating to upcoming ZITADEL versions.
As a reference, these are the default mappings:

```yaml
InternalAuthZ:
  RolePermissionMappings:
    - Role: "SYSTEM_OWNER"
      Permissions:
        - "system.instance.read"
        - "system.instance.write"
        - "system.instance.delete"
        - "system.domain.read"
        - "system.domain.write"
        - "system.domain.delete"
        - "system.debug.read"
        - "system.debug.write"
        - "system.debug.delete"
        - "system.feature.write"
        - "system.limits.write"
        - "system.limits.delete"
        - "system.quota.write"
        - "system.quota.delete"
        - "system.iam.member.read"
    - Role: "SYSTEM_OWNER_VIEWER"
      Permissions:
        - "system.instance.read"
        - "system.domain.read"
        - "system.debug.read"
...
```

## Impact

If the system users don't have the correct memberships and roles which resolve to permissions, the system users lose access to the system API.