# Migration Example: Personal Access Tokens


{{< announcement >}}
**Permissions Management (RBAC) deprecation timeline**

The legacy [Permissions Management (RBAC) system]({{< ref "access-management/glossary.md#role-based-access-control-rbac" >}}) will be **deprecated on October 31, 2026**. RudderStack recommends completing your migration before this date.

- [Understand the pre-migration considerations]({{< ref "access-management/pre-migration-considerations.md" >}})
- [Start your migration now]({{< ref "access-management/migration-steps.md" >}})
- [Learn how the migration works]({{< ref "access-management/how-migration-works.md" >}})
{{< /announcement >}}

The examples in this guide show how Personal Access Tokens with different scopes are migrated.

## Scenario 1

Suppose a user has the following permissions in the [legacy Permissions Management (RBAC) system]({{< ref "archive/dashboard-guides/user-management.md#role-permissions" >}}):

- **Connections Editor** role with permissions to edit, connect, and disconnect resources (sources, destinations, Tracking Plans, etc.)
- **Full edit access** to create, edit, and delete transformations and transformation libraries

{{< image src="images/access-management/migration/connections-editor.webp" alt="Connections Editor role permissions" >}}

### Read-only scope {#read-only-scope-scenario-1}

If the above user creates a Personal Access Token with the **Read-Only** scope, the token will have the following permissions after migration:

#### What they can do

- View PII data in the workspace

#### What they cannot do

- **Create and delete** resources in the workspace, including transformations and transformation libraries
- **Edit** resource configurations, including transformations and transformation libraries
- **Connect** and **disconnect** resources

### Read-write scope {#read-write-scope-scenario-1}

If the above user creates a Personal Access Token with the **Read-Write** scope, the token will have the following permissions after migration:

#### What they can do

- **Edit** resource configurations, including transformations and transformation libraries
- **Connect** and **disconnect** resources, including transformations and transformation libraries
- **Create and delete** transformations and transformation libraries
- View PII data in the workspace

#### What they cannot do

- **Create and delete** other resources in the workspace (sources, destinations, Tracking Plans, etc.)

## Scenario 2

Suppose a user has the following permissions in the [legacy RBAC system]({{< ref "archive/dashboard-guides/user-management.md#role-permissions" >}}):

- **Connections Editor** role with permissions to edit, connect, and disconnect resources (sources, destinations, Tracking Plans, etc.)
- **No edit access** to create, edit, and delete transformations and transformation libraries

{{< image src="images/access-management/migration/connections-editor-pre-migration-permissions.webp" >}}

### Read-only scope {#read-only-scope-scenario-2}

If the above user creates a Personal Access Token with the **Read-Only** scope, the token will have the following permissions after migration:

#### What they can do

- View PII data in the workspace

#### What they cannot do

- **Create and delete** resources in the workspace, including transformations and transformation libraries
- **Edit** resource configurations, including transformations and transformation libraries
- **Connect** and **disconnect** resources

### Read-write scope {#read-write-scope-scenario-2}

If the above user creates a Personal Access Token with the **Read-Write** scope, the token will have the following permissions after migration:

#### What they can do

- **Edit** resource configurations, **except** transformations and transformation libraries
- **Connect** and **disconnect** resources, **including** transformations and transformation libraries
- View PII data in the workspace

#### What they cannot do

- **Create and delete** resources in the workspace, **including** transformations and transformation libraries