MM-69100 - Add team membership ABAC documentation and update channel ABAC pages for team support

[pvev]

…

Summary

Documents the Team Membership ABAC feature (PR #37054 / MM-69100) and updates the existing ABAC docs to reflect that policies can now be assigned to teams, not just channels.

What's included

New page — abac-team-membership.rst:

• Advisory (public) vs strict (private) enforcement model, keyed on allow_open_invite
• Prerequisites + feature-flag behavior matrix (what changes when
  EnableAttributeBasedAccessControl / TeamMembershipAccessControl are off)
• System Admin config: policy assignment, custom rules, both auto-add checkboxes, sync
  footer, Membership sync jobs Teams tab
• Team Admin config: Team Membership tab, system-policy banner, custom rules, auto-add,
  test matching users, save confirmation, self-exclusion block, sync footer
• End-user surfaces: Browse Teams (hidden / Recommended chip), Invite modal, Add Members
  admin flow, Team Members modal, removal/auto-add DMs
• Policy inheritance, sync execution order, mass-removal guardrail, group-sync mutual
  exclusivity
• Troubleshooting FAQ

Access tab UI change (all deployments): Prominently documents that the "Allow any
user to join" checkbox is permanently replaced by Public/Private selection cards on
every team, regardless of ABAC or license. The cards control the single
allow_open_invite field (same field the checkbox did); type is intentionally left
untouched.

Updated pages:

• attribute-based-access-control.rst — toctree entry, team policy type, deduped roles
  lists
• abac-system-wide-policies.rst — "Assign policies to teams" section; delete now
  requires 0 channels and 0 teams
• abac-team-channel-policies.rst — "Membership Policies" tab renamed to "Channel
  Membership"; disambiguation note vs. the new Team Membership tab

Ticket Link

https://mattermost.atlassian.net/browse/MM-69100

[github-actions]

Newest code from mattermost has been published to preview environment for Git SHA 75b10e9

[pvev]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[github-actions]

Newest code from mattermost has been published to preview environment for Git SHA 20fe15f

[coderabbitai]

📝 Walkthrough

Walkthrough

The administration guide documents team membership ABAC, separates it from channel membership policies, and updates system-wide policy assignment, enforcement, administration workflows, synchronization, troubleshooting, and policy deletion guidance.

Changes

ABAC administration guidance

Layer / File(s)	Summary
ABAC model and administration navigation source/administration-guide/manage/admin/attribute-based-access-control.rst, source/administration-guide/manage/admin/abac-team-channel-policies.rst	The guide separates team membership and channel membership policies. It documents their settings locations, administrators, tab names, visibility requirements, and public-team and private-team enforcement modes.
Team membership policy behaviour source/administration-guide/manage/admin/abac-team-membership.rst	The new guide documents team access modes, policy assignment, synchronization, administrator workflows, end-user behaviour, notifications, troubleshooting, and FAQ guidance.
System-wide and channel policy workflows source/administration-guide/manage/admin/abac-system-wide-policies.rst, source/administration-guide/manage/admin/abac-team-channel-policies.rst	The documentation covers system-wide policy assignment to teams, deletion constraints, Channel Membership tab terminology, cross-team policy visibility, and troubleshooting references.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the new team membership ABAC documentation and updates for team support in channel ABAC pages.
Description check	✅ Passed	The description directly explains the new team membership ABAC page and the related updates to existing ABAC documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch MM-69100-team-abac-membership-docs

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@source/administration-guide/manage/admin/abac-system-wide-policies.rst`:
- Around line 118-125: Update the team-assignment procedure around the
Membership Policy section to state that administrators must first enable “Manage
membership with attribute based membership policies” for the team, and that
group-synced teams cannot use this control. Describe the required setting
sequence before instructing them to link an existing policy, or link directly to
the complete procedure in the team membership access policies documentation.

In `@source/administration-guide/manage/admin/abac-team-membership.rst`:
- Around line 124-129: Update the “Join gate (private teams)” and “Browse Teams
filter” cells in the ABAC-disabled row to describe standard private-team
behavior: joining remains invite-only, and visibility remains restricted to
members. Do not imply that disabling ABAC makes private teams open or visible to
everyone.
- Around line 25-27: The documentation’s universal claims about the Access tab
omit the exception for LDAP/AD group-synced teams. Update the important notice
and the related statements around the Public Team and Private Team cards to
limit them to non-group-synced teams or explicitly state that group-synced teams
display the static message described near the group-sync guidance.
- Line 434: Update the synchronization timing references in the admin guide,
including the team and channel membership scheduler descriptions, to use
AccessControlSettings.SyncJobIntervalSeconds and state a maximum wait of 60
minutes. Replace the outdated 30-minute references while preserving the
documented 3600-second default and shared scheduling behavior.

In `@source/administration-guide/manage/admin/attribute-based-access-control.rst`:
- Line 19: Update the authorization claim in the paragraph to accurately reflect
strict enforcement: replace the statement that only authorized users can access
Mattermost channels and teams with wording that strict policies can manage
access, or explicitly scope the claim to private channels and teams. Preserve
the surrounding explanation about security, compliance, and manual role
adjustments.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 44109363-c136-4816-9d51-52f4af12ccc4

📥 Commits

Reviewing files that changed from the base of the PR and between f64a5a5 and 20fe15f.

📒 Files selected for processing (4)

• source/administration-guide/manage/admin/abac-system-wide-policies.rst
• source/administration-guide/manage/admin/abac-team-channel-policies.rst
• source/administration-guide/manage/admin/abac-team-membership.rst
• source/administration-guide/manage/admin/attribute-based-access-control.rst

[github-actions]

Newest code from mattermost has been published to preview environment for Git SHA 9b20a4e

[pvev]

The docs were verified and updated with the latest changes we did on the feature. This is ready for review @amyblais @Combs7th . Let me know if you have any questions.

[amyblais]

The docs were verified and updated with the latest changes we did on the feature. This is ready for review . Let me know if you have any questions.

Thank you!

[Combs7th]

Thanks for the thorough updates, @pvev! One small consistency point: the Channel Membership page says scheduled sync runs every 30 minutes, while the Team Membership page says the default is 60 minutes. Could we align those values? Otherwise, this looks good to approve to me from an Editor perspective.

Is there a dev you can tag for the dev review on this as well?

[github-actions]

Newest code from mattermost has been published to preview environment for Git SHA b64cbaa

[pvev]

Thanks for the thorough updates, @pvev! One small consistency point: the Channel Membership page says scheduled sync runs every 30 minutes, while the Team Membership page says the default is 60 minutes. Could we align those values? Otherwise, this looks good to approve to me from an Editor perspective.

Is there a dev you can tag for the dev review on this as well?

Good catch, thanks @Combs7th . Both schedulers are built from the same interval, so they've never actually differed. It used to be a hardcoded hour and is now configurable via AccessControlSettings.SyncJobIntervalSeconds (default 3600s). The "30 minutes" figure didn't match the old behaviour either, so I updated abac-channel-access-rules.rst and abac-team-channel-policies.rst to say 60 minutes and name the setting. All four ABAC pages are consistent now.

[davidkrauser]

Looks good to me - thanks for keeping these up to date.

[davidkrauser]

Team-scoped channel membership policies - lol, that's a mouthful.

[github-actions]

Newest code from mattermost has been published to preview environment for Git SHA b64cbaa

[Combs7th]

@pvev - I think this one's good to merge now?

[marianunez]

Access tab UI change (all deployments): Prominently documents that the "Allow any
user to join" checkbox is permanently replaced by Public/Private selection cards on
every team, regardless of ABAC or license. The cards control the single
allow_open_invite field (same field the checkbox did); type is intentionally left
untouched.

@pvev was this included in this PR? It seems this is focused on the ABAC pages but we should include that update in the team settings docs here https://docs.mattermost.com/end-user-guide/collaborate/team-settings.html#access-settings