# AWX RBAC Question

**URL:** <https://forum.ansible.com/t/awx-rbac-question/35347>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [June 14, 2021, 7:56pm UTC](https://forum.ansible.com/t/awx-rbac-question/35347 "2021-06-14T19:56:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matt\_Lincoln](https://avatars.discourse-cdn.com/v4/letter/m/e79b87/32.png) [@Matt\_Lincoln](https://forum.ansible.com/u/Matt_Lincoln)\
**Post date:** [June 14, 2021, 7:56pm UTC](https://forum.ansible.com/t/awx-rbac-question/35347/1 "2021-06-14T19:56:16Z")

</div>

I’m working on getting one of our AWX instances in a full RBAC model, but some users are reporting odd behavior around the “copy” permission specifically for projects. During my testing, it seems like the “copy” permission is managed in some other way besides organization/team permissions. Is this option only available to super users or could it have something to do with the projects being created by a super user?

I would have expected that an organization admin would have the required permissions to copy projects owned by that organization, but that does not seem to be the case. This behavior is the same if I explicitly set project admin for that user.

Strangely enough, I have found that if I give my test user org admin from another specific organization, it ends up getting the copy capability for all the projects in the original org and the new org that was added. This leads me to believe there is something up with the new org, but I can at least state that the user is not a system admin all of a sudden (according to the is\_superuser field)

AWX version: 14.1.0, 17.1.0

Example:

Project: test\_project  
Org: test\_org

User: testuser  
Org: test\_org  
Team: test\_team  
Permissions: test\_org admin

testuser user\_capabilities for project:

“user\_capabilities”: {  
“edit”: true,  
“delete”: true,  
“start”: true,  
“schedule”: true,  
“copy”: false  
}

System Administrator user\_capabilities for project:

“user\_capabilities”: {  
“edit”: true,  
“delete”: true,  
“start”: true,  
“schedule”: true,  
“copy”: true  
}

Thanks,

Matt