Configure Environment-Level Permissions to Manage Feature Flag Rules using Open Access

Overview

In VWO, managing feature flag rules, such as enabling or disabling them, typically requires a user to have account-level Publish permissions. This standard security measure ensures that only authorized personnel can enable or disable rules. However, this can create a bottleneck for users or teams, who often have more restricted access levels (such as Design or Browse) and cannot test their changes without an administrator's assistance.

VWO’s Open Access feature solves this challenge. It enables an administrator to override this permission requirement for specific environments. By enabling Open Access for an environment, you can empower teams to independently activate and deactivate rules for testing purposes, without granting them risky access to your production environment.

For example, your developers have Design access. They can create feature flag rules, but cannot enable them in the Development environment to test their code. They must wait for a team member with Publish access to do it for them. In this case, admins or account owners can enable Open Access for the Development environment. Now, the developers can freely turn their feature flag rules on and off within that specific environment, while their access to other production environments remains restricted.

Or, your organization brings in a team of contractors to work on a specific project. You want them to be able to test their work in a Staging environment, but you do not want to give them permanent Publish rights that could affect other parts of your application. In this case, admins or account owners can enable Open Access on the Staging environment. The contract team can manage flags for their project as needed. Once the project is complete, you can disable Open Access for that environment.

This article further explains how to enable open access for environments in your VWO account.

Prerequisites

• You must have Account Owner or Admin-level permissions to enable or disable the Open Access feature for an environment. For more information, see Understanding VWO Account Hierarchy.
• You must have multiple environments configured within your VWO Feature Experimentation project. For example, Development, Staging, and Production environments are configured by default for all accounts.

Enable or Disable Open Access

To enable the open access feature for an environment:

1. Log in to your VWO account.
2. From the main navigation panel on the left, go to Configurations > Websites and Apps.
3. Select the Feature Experimentation project for which you want to configure this setting and navigate to the Configurations tab. You will see a list of all configured environments for that project, such as Prod, Staging, and Dev.
   
4. Locate the environment where you want to grant open access. Under the environment name, you will see a toggle labeled Enable open access. Click this toggle to turn it on. A confirmation dialog appears. Click Enable to confirm your choice.
5. After enabling the toggle for the desired environment(s), click Save to apply the changes.

To disable the feature for an environment, simply follow the same steps listed above, toggle Enable open access to the off position, click Disable to confirm your choice, and then save your changes.

Verify if Open Access is Enabled

To verify if open access is enabled for the environment, go to the feature flag you want to work with. Inside the feature flag, go to the Rules tab. On the left, you will see the list of environments. The environment with Open Access enabled displays the icon next to its name. Hovering over the icon reveals the Open Access badge. This confirms Open Access is successfully enabled for that environment.

All users, regardless of their access level, can independently activate or deactivate the rules within this feature flag on the environment with Open Access enabled. The users’ permissions for all other environments (such as Staging) that do not have Open Access enabled will remain unchanged and restricted based on their account-level role.

VWO recommends performing regular audits. Periodically review which environments have Open Access enabled to ensure the configuration aligns with your organization's current security policies and workflows.

Troubleshooting

FAQs

• Can I enable Open Access for multiple environments at once?
  Yes. You can enable open access for multiple environments simultaneously.
   
• What happens to a rule if it was enabled via Open Access, and then an admin disables Open Access for that environment?
  The rule remains in its last state. If the rule was left On, it will stay On. However, users without Publish-level access will no longer be able to change its state until Open Access is re-enabled.
   
• Does Open Access allow users to change other campaign settings, like metrics or variables?
  No. Open Access is limited explicitly to enabling and disabling existing rules within the feature flag. Broader campaign modifications still adhere to the user's standard account-level permissions.
   
• What if a user already has Publish-level access? Does Open Access affect them?
  No. For a user who already has Publish-level access, the Open Access setting is redundant. Their existing permissions already allow them to perform these actions, so they will not notice any change.
   
• Are changes made under Open Access logged? How can we maintain accountability?
  Yes. All changes, regardless of how they are made, are tracked in the Activity Timeline. You can filter the timeline to see which user enabled or disabled a specific rule and when the change occurred.
   
• Can Open Access be granted to specific users only, instead of the entire workspace?
  No. The current functionality enables Open Access for all users within the VWO workspace for the selected environment.

Need more help?

For further assistance or more information, contact VWO Support.