August '26 news

August is the big one: Seatsurfing ships a completely new role and permission model. It's the largest change to administration we've made in a long time, and if you run Seatsurfing today, it's worth reading before you upgrade. Alongside it, the usual round of smaller improvements and fixes.

🔐 A new role and permission model

Until now, access in Seatsurfing was decided by a fixed set of roles — Space Administrator, Organization Administrator, and so on — each with a hard-coded meaning. If you wanted someone to manage group membership without giving them anything else, or an assistant who could see the presence report but not touch users, there was no way to express that. It was all or nothing.

That changes now. Roles are no longer fixed — they're named sets of permissions that an organization administrator defines, and any user can hold any number of them. Every functionality — users, groups, areas, the audit log, and more — can be granted at its own level, from no access up to full access. Where someone holds several roles, the highest level any of them grants wins.

Why this matters for existing organizations:

• Fine-grained delegation. You can finally hand someone exactly the slice of administration they need — group membership only, floor plan management without touching users, read-only access to statistics for a manager — instead of promoting them to full administrator or leaving them locked out.
• Least privilege by default. Service accounts and API tokens are assigned roles the same way users are, so an integration can be scoped to only the endpoints it actually calls.
• Nothing is hard-coded anymore. The built-in roles — Organization Administrator, Floor Plan Administrator, API access — are just a starting point. Edit or delete them freely; only the Organization Administrator role itself is protected, so an organization can never lock itself out of its own administration.
• Centrally managed access. Where users sign in through an OAuth2 or OIDC provider, roles can be assigned automatically from a claim in the token, keeping access management in your identity provider instead of duplicating it in Seatsurfing.

Existing installations are migrated automatically: your current roles are converted into equivalent permission sets, so nobody wakes up locked out. But because this touches the core of how access is decided, we'd strongly recommend reviewing your organization's roles after upgrading, particularly if you rely on custom role assignments via OAuth2/OIDC claims or on service account permissions.

Full details — including the permission table, the built-in roles, and a worked example of building a custom role — are in the new Roles and Permissions documentation.

More from August

🌗 Theme support in the Booking UI

The booking interface now supports light and dark themes, matching the Admin UI.

🔍 Autocompleter when adding buddies

Adding a buddy in the Booking UI now suggests matches as you type, instead of requiring an exact email address.

📜 Audit log for authentication attempts

Administrators can review a log of authentication attempts, making it easier to spot suspicious sign-in activity.

🏷️ User roles shown on group members

Group member lists in the Admin UI now show each member's role at a glance.

🌐 Cleaner domain administration

Domains and authentication providers are now listed in a consistent order, and the domain admin interface has been streamlined.

📋 More details

As always, you can find detailed information about all releases and technical changes on our GitHub releases page.

Ready to transform your workplace with smart desk booking? Get started with Seatsurfing today for free or get in touch with us.