Cannot share roles across multiple Channels in Multi-Vendor setups

Required for the review round. Visual PR companion for vendurehq/vendure#5163: PR stats, Admin API GraphQL before/after, envelope logic. Open the review companion

Current direction (2026-08-24). RoleAssignment (user, role, channel) becomes the core permission model, shipped as a major breaking change (decided 2026-08-13, see the decision comment). The opt-in plugin approach and the ChannelRole PoC proposed below were abandoned. Single source of truth: Implementation plan: role assignments in core (major). Active PR: vendurehq/vendure#5163.

Progress is tracked in the sub-issues (stages closed as done, open work + a follow-ups collector). The attached docs are the detail layer; the four superseded ones were moved to the OSS team docs space (links unchanged).

Problem Description

In the current Vendure architecture, roles are tightly coupled with channel assignments, making it impossible to share role definitions across multiple channels in multi-vendor marketplace scenarios. This creates significant administrative overhead and limitations for marketplace operators.

Current Behavior

• Each role contains both permissions AND the channels where those permissions apply
• Users are assigned roles directly, which means they inherit both the permissions and channel access from those roles
• In a multi-vendor setup, if vendors need the same permissions (e.g., "Product Manager", "Order Fulfillment"), separate roles must be created for each vendor's channel
• This leads to role proliferation (e.g., "VendorA_ProductManager", "VendorB_ProductManager", etc.)

Impact

This limitation causes several problems:

1. Role Management Overhead: Marketplace operators must create and maintain duplicate roles for each vendor/channel
2. Lack of Isolation: When users share roles, they can potentially see each other's channels, breaking vendor isolation
3. Scalability Issues: As the number of vendors grows, the number of roles grows multiplicatively
4. Maintenance Complexity: Updating permissions requires changes across multiple duplicate roles

Expected Behavior

• Roles should define permissions independently of channel assignments
• Users should be able to have the same role applied to different channels
• Vendors should be able to share role definitions without seeing each other's data
• Channel-specific permissions should be managed through a separate association

Use Case Example

A marketplace with 50 vendors where each vendor needs:

• Product Manager role
• Order Fulfillment role
• Customer Service role

Current approach requires: 50 × 3 = 150 separate role definitions Desired approach: 3 shared role definitions, with channel-specific assignments

Proposed Solution (historical, superseded by the implementation plan linked above)

Introduce a bridge entity (ChannelRole) that associates Users, Roles, and Channels separately, allowing:

• Shared role definitions across the marketplace
• Channel-specific permission assignments
• Proper vendor isolation while maintaining role consistency
• Simplified role management at scale

This would enable marketplace operators to define roles once and assign them to users on a per-channel basis, significantly reducing complexity in multi-vendor scenarios.

The PR #3222 introduces a PoC.

This is a summary of dev interviews and conversation in the issue #3095