From aad75b4981b190752e7ee4e1a6b0034112d9b7fe Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Wed, 26 Aug 2026 01:39:50 -0700
Subject: [PATCH] Docs: clarify app config trust
---
docs/configuration.md | 10 ++++++++++
docs/usage.md | 42 +++++++++++++++++++++---------------------
2 files changed, 31 insertions(+), 21 deletions(-)
diff --git a/docs/configuration.md b/docs/configuration.md
index 5d7be5972..6c619da40 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -8,6 +8,12 @@ common [OCR](#ocr) related settings and some frontend settings. If set, these wi
preference over the settings via environment variables. If not set, the environment setting
or applicable default will be utilized instead.
+!!! warning
+
+ Changing configuration from the UI requires the `AppConfig` permission, which applies
+ instance-wide and should be treated as an admin-level permission. See
+ [global permissions](usage.md#global-permissions).
+
- If you run paperless on docker, `paperless.conf` is not used.
Rather, configure paperless by copying necessary options to
`docker-compose.env`.
@@ -1106,6 +1112,10 @@ they use underscores instead of dashes.
so specifying invalid options may prevent paperless from consuming
any documents. Use with caution!
+ These arguments are passed directly to OCRmyPDF, so this setting should only
+ be changed by trusted users. This applies to the `AppConfig` permission as well,
+ which allows setting these arguments from the UI.
+
Specify arguments as a JSON dictionary. Keep note of lower case
booleans and double quoted parameter names and strings. Examples:
diff --git a/docs/usage.md b/docs/usage.md
index bd03c9a51..a775e2a9a 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -423,27 +423,27 @@ Global permissions define what areas of the app and API endpoints users can acce
determine if a user can create, edit, delete or view _any_ documents, but individual documents themselves
still have "object-level" permissions.
-| Type | Details |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| AppConfig | _Change_ or higher permissions grants access to the "Application Configuration" area. |
-| Correspondent | Add, edit, delete or view Correspondents. |
-| CustomField | Add, edit, delete or view Custom Fields. |
-| Document | Add, edit, delete or view Documents. |
-| DocumentType | Add, edit, delete or view Document Types. |
-| Group | Add, edit, delete or view Groups. |
-| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents. |
-| MailAccount | Add, edit, delete or view Mail Accounts. |
-| MailRule | Add, edit, delete or view Mail Rules. |
-| Note | Add, edit, delete or view Notes. |
-| PaperlessTask | View or dismiss (_Change_) File Tasks. |
-| SavedView | Add, edit, delete or view Saved Views. |
-| ShareLink | Add, delete or view Share Links. |
-| StoragePath | Add, edit, delete or view Storage Paths. |
-| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access. |
-| Tag | Add, edit, delete or view Tags. |
-| UISettings | Add, edit, delete or view the UI settings that are used by the web app.
:warning: **Users that will access the web UI must be granted at least _View_ permissions.** |
-| User | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`. |
-| Workflow | Add, edit, delete or view Workflows.
Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
+| Type | Details |
+| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| AppConfig | _Change_ or higher permissions grants access to the "Application Configuration" area.
:warning: **This is a trusted, admin-level permission.** Application configuration applies instance-wide and some settings, such as OCR arguments, are passed directly to the underlying processing tools. |
+| Correspondent | Add, edit, delete or view Correspondents. |
+| CustomField | Add, edit, delete or view Custom Fields. |
+| Document | Add, edit, delete or view Documents. |
+| DocumentType | Add, edit, delete or view Document Types. |
+| Group | Add, edit, delete or view Groups. |
+| GlobalStatistics | View aggregate object counts and statistics. This does not grant access to view individual documents. |
+| MailAccount | Add, edit, delete or view Mail Accounts. |
+| MailRule | Add, edit, delete or view Mail Rules. |
+| Note | Add, edit, delete or view Notes. |
+| PaperlessTask | View or dismiss (_Change_) File Tasks. |
+| SavedView | Add, edit, delete or view Saved Views. |
+| ShareLink | Add, delete or view Share Links. |
+| StoragePath | Add, edit, delete or view Storage Paths. |
+| SystemMonitoring | View the system status dialog, tasks summary and their API endpoints. Admin users also retain system status access. |
+| Tag | Add, edit, delete or view Tags. |
+| UISettings | Add, edit, delete or view the UI settings that are used by the web app.
:warning: **Users that will access the web UI must be granted at least _View_ permissions.** |
+| User | Add, edit, delete or view other user accounts via Settings > Users & Groups and `/api/users/`. These permissions are not needed for users to edit their own profile via "My Profile" or `/api/profile/`. |
+| Workflow | Add, edit, delete or view Workflows.
Note that Workflows are global; all users who can access workflows see the same set. Workflows have other permission implications — see [Workflow permissions](#workflow-permissions). |
#### Detailed Explanation of Object Permissions {#object-permissions}