coder · ibetitsmike · Aug 26, 2026 · Aug 14, 2026 · Aug 25, 2026 · Aug 25, 2026
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
@@ -847,6 +847,12 @@ func SlimRolesFromNames(names []string) []codersdk.SlimRole {
 	convertedRoles := make([]codersdk.SlimRole, 0, len(names))
 
 	for _, name := range names {
+		// Stored role arrays may retain retired built-in role names until
+		// a cleanup migration lands. Hide them so consumers do not display
+		// or resubmit them.
+		if rbac.IsRetiredRoleName(name) {
+			continue
+		}
 		convertedRoles = append(convertedRoles, SlimRoleFromName(name))
 	}
 
@@ -919,11 +925,14 @@ func Organization(organization database.Organization) codersdk.Organization {
 			DisplayName: organization.DisplayName,
 			Icon:        organization.Icon,
 		},
-		Description:           organization.Description,
-		CreatedAt:             organization.CreatedAt,
-		UpdatedAt:             organization.UpdatedAt,
-		IsDefault:             organization.IsDefault,
-		DefaultOrgMemberRoles: organization.DefaultOrgMemberRoles,
+		Description: organization.Description,
+		CreatedAt:   organization.CreatedAt,
+		UpdatedAt:   organization.UpdatedAt,
+		IsDefault:   organization.IsDefault,
+		// Stored default role lists may retain retired built-in role names
+		// until a cleanup migration lands. Hide them so settings forms do
+		// not display or resubmit them.
+		DefaultOrgMemberRoles: slices.DeleteFunc(slices.Clone(organization.DefaultOrgMemberRoles), rbac.IsRetiredRoleName),
 	}
 }
 

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -1413,6 +1413,15 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID uuid.UUID, added, re
 	grantedRoles := make([]rbac.RoleIdentifier, 0, len(added)+len(removed))
 	grantedRoles = append(grantedRoles, added...)
 	grantedRoles = append(grantedRoles, removed...)
+	// Retired role names may linger in stored role arrays and org default
+	// role lists until a data cleanup migration lands. They expand to no
+	// permissions and cannot be re-created as custom roles, so validating
+	// them is unnecessary: the added set only contains them via stored
+	// data (implied org defaults), never via explicit grants, which the
+	// role-update paths reject before reaching this filter.
+	grantedRoles = slices.DeleteFunc(grantedRoles, func(r rbac.RoleIdentifier) bool {
+		return rbac.IsRetiredRoleName(r.Name)
+	})
 	customRoles := make([]rbac.RoleIdentifier, 0)
 	// Validate that the roles being assigned are valid.
 	for _, r := range grantedRoles {
@@ -7866,6 +7875,16 @@ func (q *querier) UpdateMemberRoles(ctx context.Context, arg database.UpdateMemb
 	if err != nil {
 		return database.OrganizationMember{}, err
 	}
+	// Explicitly granting a retired role is rejected. Retired-name tolerance
+	// only covers stored grants and implied org defaults that linger until
+	// the cleanup migration lands; without this check the request would
+	// skip validation and persist a hidden grant that a binary rollback
+	// resolves again.
+	for _, role := range scopedGranted {
+		if rbac.IsRetiredRoleName(role.Name) {
+			return database.OrganizationMember{}, xerrors.Errorf("role %q is retired and cannot be assigned", role.Name)
+		}
+	}
 
 	// The org's default_org_member_roles are implied at request time by
 	// GetAuthorizationUserRoles. Include them in the implied set so
@@ -7942,6 +7961,15 @@ func (q *querier) UpdateOrganization(ctx context.Context, arg database.UpdateOrg
 			scopedOrgRoleIdentifiers(existing.DefaultOrgMemberRoles, arg.ID),
 			scopedOrgRoleIdentifiers(arg.DefaultOrgMemberRoles, arg.ID),
 		)
+		// Newly added defaults must not include retired names, which
+		// canAssignRoles tolerates only so stale stored defaults keep
+		// working until the cleanup migration lands. Removals stay
+		// tolerated so those stale defaults can be cleaned up.
+		for _, role := range added {
+			if rbac.IsRetiredRoleName(role.Name) {
+				return database.Organization{}, xerrors.Errorf("role %q is retired and cannot be a default role", role.Name)
+			}
+		}
 		if err := q.canAssignRoles(ctx, arg.ID, added, removed); err != nil {
 			return database.Organization{}, err
 		}
@@ -8492,6 +8520,15 @@ func (q *querier) UpdateUserRoles(ctx context.Context, arg database.UpdateUserRo
 		return database.User{}, err
 	}
 
+	// Explicitly granting a retired role is rejected. Retired-name tolerance
+	// only covers stored grants that linger until the cleanup migration
+	// lands.
+	for _, roleName := range arg.GrantedRoles {
+		if rbac.IsRetiredRoleName(roleName) {
+			return database.User{}, xerrors.Errorf("role %q is retired and cannot be assigned", roleName)
+		}
+	}
+
 	// The member role is always implied.
 	impliedTypes := append(q.convertToDeploymentRoles(arg.GrantedRoles), rbac.RoleMember())
 	// If the changeset is nothing, less rbac checks need to be done.

diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
@@ -1465,8 +1465,8 @@ func TestGetAuthorizedChats(t *testing.T) {
 
 	org := dbgen.Organization(t, db, database.Organization{})
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: owner.ID, OrganizationID: org.ID})
-	dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: member.ID, OrganizationID: org.ID, Roles: []string{rbac.RoleAgentsAccess()}})
-	dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: secondMember.ID, OrganizationID: org.ID, Roles: []string{rbac.RoleAgentsAccess()}})
+	dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: member.ID, OrganizationID: org.ID})
+	dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: secondMember.ID, OrganizationID: org.ID})
 
 	// Create FK dependencies: a chat provider and model config.
 	_ = dbgen.ChatProvider(t, db, database.ChatProvider{
@@ -1653,7 +1653,7 @@ func TestGetAuthorizedChats(t *testing.T) {
 		// Use a dedicated user for pagination to avoid interference
 		// with the other parallel subtests.
 		paginationUser := dbgen.User(t, db, database.User{})
-		dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: paginationUser.ID, OrganizationID: org.ID, Roles: []string{rbac.RoleAgentsAccess()}})
+		dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: paginationUser.ID, OrganizationID: org.ID})
 		for i := range 7 {
 			dbgen.Chat(t, db, database.Chat{
 				OrganizationID:    org.ID,
@@ -1727,12 +1727,10 @@ func TestGetAuthorizedChatsACLSharing(t *testing.T) {
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{
 		UserID:         owner.ID,
 		OrganizationID: org.ID,
-		Roles:          []string{rbac.RoleAgentsAccess()},
 	})
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{
 		UserID:         recipient.ID,
 		OrganizationID: org.ID,
-		Roles:          []string{rbac.RoleAgentsAccess()},
 	})
 
 	dbgen.ChatProvider(t, db, database.ChatProvider{Provider: "openai", DisplayName: "OpenAI"})
@@ -1845,12 +1843,10 @@ func TestGetAuthorizedChatsACLSharingGroupACL(t *testing.T) {
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{
 		UserID:         owner.ID,
 		OrganizationID: org.ID,
-		Roles:          []string{rbac.RoleAgentsAccess()},
 	})
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{
 		UserID:         recipient.ID,
 		OrganizationID: org.ID,
-		Roles:          []string{rbac.RoleAgentsAccess()},
 	})
 	group := dbgen.Group(t, db, database.Group{OrganizationID: org.ID})
 	dbgen.GroupMember(t, db, database.GroupMemberTable{UserID: recipient.ID, GroupID: group.ID})
@@ -1949,12 +1945,10 @@ func TestGetAuthorizedChatsByChatFileIDACLSharing(t *testing.T) {
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{
 		UserID:         owner.ID,
 		OrganizationID: org.ID,
-		Roles:          []string{rbac.RoleAgentsAccess()},
 	})
 	dbgen.OrganizationMember(t, db, database.OrganizationMember{
 		UserID:         recipient.ID,
 		OrganizationID: org.ID,
-		Roles:          []string{rbac.RoleAgentsAccess()},
 	})
 
 	dbgen.ChatProvider(t, db, database.ChatProvider{Provider: "openai", DisplayName: "OpenAI"})

diff --git a/coderd/exp_chats_acl_test.go b/coderd/exp_chats_acl_test.go
@@ -463,7 +463,7 @@ func TestListChatsSharedScope(t *testing.T) {
 	client, db := newChatClientWithDatabase(t)
 	firstUser := coderdtest.CreateFirstUser(t, client.Client)
 	modelConfig := createChatModel(t, client)
-	viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID, rbac.ScopedRoleAgentsAccess(firstUser.OrganizationID))
+	viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID)
 	viewerClientExp := codersdk.NewExperimentalClient(viewerClient)
 	sharedChat := dbgen.Chat(t, db, database.Chat{
 		OrganizationID:    firstUser.OrganizationID,
@@ -562,7 +562,7 @@ func TestChatSharingDisabled(t *testing.T) {
 	})
 	firstUser := coderdtest.CreateFirstUser(t, client.Client)
 	modelConfig := createChatModel(t, client)
-	viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID, rbac.ScopedRoleAgentsAccess(firstUser.OrganizationID))
+	viewerClient, viewer := coderdtest.CreateAnotherUser(t, client.Client, firstUser.OrganizationID)
 	viewerClientExp := codersdk.NewExperimentalClient(viewerClient)
 
 	chat := dbgen.Chat(t, store, database.Chat{

diff --git a/coderd/exp_chats_model_config_list_test.go b/coderd/exp_chats_model_config_list_test.go
@@ -189,13 +189,12 @@ func TestChatModelConfigListReadContracts(t *testing.T) {
 		seesDenied bool
 	}{
 		{
-			name: "AgentsAccess",
+			name: "Member",
 			client: func(t *testing.T, _ context.Context) *codersdk.ExperimentalClient {
 				rawClient, _ := coderdtest.CreateAnotherUser(
 					t,
 					client.Client,
 					defaultOrg.ID,
-					rbac.ScopedRoleAgentsAccess(defaultOrg.ID),
 				)
 				return codersdk.NewExperimentalClient(rawClient)
 			},