This is expected behavior, not a bug.

Why Code Writer can create workspaces even when "Create Workspaces" is unchecked

The built-in Code Writer role sets Code privilege = Write. Write code permission implies Create Workspaces. That is documented on the role's Code privilege field: "The Write permission implies CreateWorkspaces permission".

So even though the separate Create Workspaces checkbox is off by default for Code Writer, an AI agent with that role still has workspace-create rights via Write code. That matches what you saw: assigning Code Writer was what enabled workspace creation.

Why Issue Manager alone cannot

The built-in Issue Manager role only has Code privilege = Read (plus issue management). Read code does not imply Create Workspaces, and Issue Manager does not turn on the Create Workspaces flag. So Issue Manager alone cannot create workspaces — also matching your test.

What the separate checkbox is for

The Create Workspaces permission exists so you can grant workspace creation without full Write code. The built-in Workspace Creator role does exactly that: Create Workspaces on + Code privilege Read.

Summary

If this clears up the ambiguity, we can close the issue. If you still see a case where Create Workspaces should not be implied by Write, say so and we can dig further.

Yes — that screenshot is exactly the expected UI for Code Writer.

The Create Workspaces toggle being off only means the standalone flag is not set. Code Writer still has Code privilege = Write, and Write implies Create Workspaces. That is documented on the Code privilege field help text: "The Write permission implies CreateWorkspaces permission".

So the role screen can show Create Workspaces as disabled while anyone with that role can still create workspaces. That is by design.

If that resolves the ambiguity, we can close the issue. If you'd prefer the UI to show Create Workspaces as effectively granted when Code privilege is Write, say so and we can take that as a product-improvement request.

If code privilege is set to write, then there should be a note in the text next to create workspaces saying that this is enabled by default because of the code privilege being write. this would help clear up ambiguity for system managers. I believe this has a change that should be implemented.

The above suggestion is in addition to the Create Workspaces note inside Code Priviledge.

Agreed — a clarifying note next to Create Workspaces when Code privilege is Write would remove the ambiguity (in addition to the existing note on the Code privilege field).

I don't have permission to write code in this project (tod issue checkout --for-write failed with: No permission to write code in issue project), so I can't implement that UI change. @robin please pick this up as a product-improvement request: when Code privilege is Write, show text next to Create Workspaces indicating that workspace creation is effectively enabled because Write implies Create Workspaces.

or in fact, perhaps it's actually better to implicitly disable create workspace toggle and show it as "on" and disabled, since Code Privilege is set to right.

Agreed — that is clearer than Off-plus-a-note.

Preferred UX: when Code privilege is Write, show Create Workspaces as On and disabled (implied by Write), so the role screen reflects the effective permission.

I still can't implement this (no write-code permission in this project). @robin please pick this up as the product-improvement request.

Created https://code.onedev.io/onedev/server/~issues/2884