# Grant permission to space is not effect **URL:** \ **Category:** Kibana\ **Created:** [June 6, 2019, 5:07am UTC](https://discuss.elastic.co/t/grant-permission-to-space-is-not-effect/184494 "2019-06-06T05:07:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![messi655](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/messi655/32/47596_2.png) [@messi655](https://discuss.elastic.co/u/messi655)\ **Post date:** [June 6, 2019, 5:07am UTC](https://discuss.elastic.co/t/grant-permission-to-space-is-not-effect/184494/1 "2019-06-06T05:07:24Z")
Hi, My Elasticsearch is: 7.1.0 My Kibana is: 7.1.1 They are enabled xpack security and successful for some kind of role like `kibana_dashboard_only_user` But my problem is: - I create 2 Spaces (development and staging) and 2 users (development and staging) , I want only 1 user can see/access 1 Space (In each space I create private Dashboard with different bussiness requirement ) . I did follow [https://www.elastic.co/blog/introducing-kibana-spaces-for-organization-and-security](https://www.elastic.co/blog/introducing-kibana-spaces-for-organization-and-security) so grant permission . But now, my problem is user staging can access Space developemt. I don't want staging user access to development Space. User permission image ![user](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a608df1df366064b5e2bbf06558dc6c700b9f112.png) staging roles ![roles](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1fc8dbf1cc1db4be45ed1f9d8045c012697c5b1e.png) What am I wrong? ---
**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\ **Post date:** [June 6, 2019, 7:01pm UTC](https://discuss.elastic.co/t/grant-permission-to-space-is-not-effect/184494/2 "2019-06-06T19:01:11Z")
If you want to control individual spaces in Kibana, do not use the `kibana_user` or `kibana_dashboard_only_user` roles. These roles were built before the spaces feature was introduced and gave the user read-only access to the entire `.kibana` index. So users with these roles are able to access all spaces in Kibana. Instead, create your own roles that grant access to specific spaces. More details on this can be found [in the docs](https://www.elastic.co/guide/en/kibana/current/xpack-security-authorization.html#_spaces). We have longer term plans to improve the user experience around this, so it's more obvious in the UI that these built-in roles cannot be locked down to a specific space. ---
**Author:** ![lukeelmers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukeelmers/32/35230_2.png) [@lukeelmers](https://discuss.elastic.co/u/lukeelmers)\ **Post date:** [June 6, 2019, 10:40pm UTC](https://discuss.elastic.co/t/grant-permission-to-space-is-not-effect/184494/3 "2019-06-06T22:40:42Z")
You may find this related thread to be helpful as well: > [@Kibana User Roles, kibana\_dashboard\_only and Limit Spaces?](https://discuss.elastic.co/t/kibana-user-roles-kibana-dashboard-only-and-limit-spaces/161905/4): > > The kibana\_dashboard\_only\_user from the permissions perspective gives the user read-only access to all of Kibana. To have Kibana hide all of the other applications besides the Dashboards app, the Kibana advanced setting: xpackDashboardMode:roles should be configured to list this role so that all other applications are hidden. To create a new custom role which grants read-only access to a single space, you can use a cURL request similar to the following against the [Kibana Role API](https://www.elastic.co/guide/en/kibana/current/role-management-api.html) curl -H "kbn-… ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2019, 10:40pm UTC](https://discuss.elastic.co/t/grant-permission-to-space-is-not-effect/184494/4 "2019-07-04T22:40:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.