Enterprise RBAC

Granular role-based access control scoped to departments, teams, and individual agents. Every permission is auditable.

Capabilities

• Department-level and agent-level permission scopes
• SSO integration: SAML 2.0, OIDC, LDAP
• Immutable audit trail for every access event

Permission Model

ORG → DEPT → ROLE → PERM → RES

• Organization: the top-level tenant
• Department: Engineering, Operations, Finance, HR, etc.
• Role: Admin, Developer, Analyst, Viewer
• Permission: read, write, invoke, grant
• Resource: agents, workflows, reports, knowledge, logs

Example matrix:

Org	Department	Role	Permission	Resource
Organization	Engineering	Admin	read:all, write:agents	Agents, Workflows
Organization	Operations	Developer	read:reports	Reports
Organization	(any)	Analyst	read:reports	Reports
Organization	(any)	Viewer	read:public	Knowledge, Logs

Permission inheritance flows top-down. Overrides can be applied at any level.

Scopes

• Department-scoped roles apply only within a department's resources
• Agent-level permission grants restrict which agents a user can invoke or edit
• Permission inheritance and override: a role inherits parent permissions and may be narrowed at the department or agent level

Tier Availability

Tier	RBAC Level
Starter	Not included
Business	Standard RBAC
Enterprise	Advanced matrix-based RBAC across data sources and knowledge
Custom	Advanced + custom rules

Related

• Security: RBAC for the deeper security view
• SSO & Identity for identity federation
• Pricing for tier comparison