# Accessing UI with defaultAuthorize requires system (or temporal-system) reader access

**URL:** <https://community.temporal.io/t/accessing-ui-with-defaultauthorize-requires-system-or-temporal-system-reader-access/8685>\
**Category:** Community Support\
**Tags:** auth, web-ui\
**Created:** [June 29, 2023, 6:07am UTC](https://community.temporal.io/t/accessing-ui-with-defaultauthorize-requires-system-or-temporal-system-reader-access/8685 "2023-06-29T06:07:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nick.williams](https://avatars.discourse-cdn.com/v4/letter/n/5daacb/32.png) [@nick.williams](https://community.temporal.io/u/nick.williams)\
**Post date:** [June 29, 2023, 6:07am UTC](https://community.temporal.io/t/accessing-ui-with-defaultauthorize-requires-system-or-temporal-system-reader-access/8685/1 "2023-06-29T06:07:17Z")

</div>

The Temporal UI uses some 'readOnlyGlobalAPI’s (like list namespaces) in order to function. In order to use the UI and the defaultAuthorizer and defaultJWTClaimMapper I before v1.21.0 required any user to have a `system:read` to access the global APIs role and a `<namespace>:<role>` to perform the work they needed in there namespace.

This was was a bit of a pain as it meant anyone with UI access could always have read access to all non-system namespaces, but we lived with it.

Now in v1.21.0 the `system:read` requirement for readOnlyGlobalAPI has been changed to `temporal-system:read` which means anyone who needs to use the UI will now be able to access the `temporal-system` namespace.

Is it possible to introduce a new role specifically for ‘readOnlyGlobalAPI’ access? Something like `temporal-global-api:read`? This would allow our UI users to use the Temporal UI and only access their own namespace and the global APIs?

---

<div class="post-metadata">

**Author:** ![fouadsemaan](https://avatars.discourse-cdn.com/v4/letter/f/ba9def/32.png) [@fouadsemaan](https://community.temporal.io/u/fouadsemaan)\
**Post date:** [November 10, 2025, 10:40pm UTC](https://community.temporal.io/t/accessing-ui-with-defaultauthorize-requires-system-or-temporal-system-reader-access/8685/2 "2025-11-10T22:40:37Z")

</div>

An alternative to prevent users from reading workflows other than in their namespaces is to give the ability to go directly to their namespace in the address bar, i.e. remove the need to “list namespaces”. I believe that requires a change in the UI layout.