Native Airflow Dags Level Roles on Airflow 3.2.0

[Emile1917]

Hello Everyone , I would like to know if there is anyway to create Dag-levels Roles on Aiflow 3.2.0 as it was on 2.8.x and lower versions ? If yes , what are the prerequisites and requirements?

[cookesan]

Yes, if you are using the FAB auth manager. DAG-level roles are still documented for Airflow 3.

The current model is resource/action based. A user can get broad permissions such as DAGs.can_read, or permissions for one DAG via a resource named Dag:<dag_id>, for example Dag:my_dag.can_read or Dag:my_dag.can_edit.

The usual setup is:

• keep the built-in roles unchanged
• create custom roles as an Admin user, either in the UI or with airflow roles create
• assign those roles to users with the UI or airflow users add-role
• grant the role only the DAG resources it should access

You can also put DAG-level access in code with the DAG's access_control argument, but be careful with that path. The docs say access_control is authoritative: setting it on a DAG can overwrite DAG-level permissions stored in the DB, and access_control={} can wipe them for that DAG.

[mateuscarestiato]

Hi @Emile1917! DAG-level access control changed significantly in Airflow 3.x with the removal of FAB (Flask-AppBuilder) as the default auth manager.

What changed from Airflow 2.x:

In Airflow 2.8 and below, DAG-level permissions were managed through FAB roles using permissions like can_read on DAG:my_dag_id. In Airflow 3.x, FAB is no longer the default — SimpleAuthManager is the new default, and it does not support DAG-level roles natively.

Options in Airflow 3.2.0:

Option 1: Use the API with asset-based access (native 3.x approach) Airflow 3.x is moving toward a new access model. Currently, SimpleAuthManager supports only admin/viewer-level roles globally.

Option 2: Re-enable FabAuthManager (backwards compatible) If you need DAG-level roles like in 2.x, you can explicitly use FabAuthManager:

ini

airflow.cfg

[core]
auth_manager = airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager
Requires: pip install apache-airflow-providers-fab

Then DAG-level permissions work as before:

can_read on DAG:specific_dag_id → read-only access to that DAG
can_edit on DAG:specific_dag_id → can trigger/pause that DAG
Option 3: Use Keycloak / external IdP with custom auth manager For enterprise setups, implement a custom BaseAuthManager that maps user groups to DAG IDs.

Prerequisites for FabAuthManager in 3.2.0:

apache-airflow-providers-fab >= 2.0.0
Run airflow db migrate after enabling
Re-create roles via the UI or airflow roles create
The roadmap for native DAG-level RBAC in SimpleAuthManager is tracked in the Airflow GitHub issues — worth watching if you prefer not to use FAB.

Let me know if you need help setting up FabAuthManager!