Role-Based Access Control

Fine-grained permissions at the department, team, and agent level. Ensure the right people access only what they need.

Capabilities

• Department-scoped roles
• Agent-level permission grants
• Permission inheritance and override

Permission Hierarchy

ORG → DEPT → ROLE → PERM → RES

Layer	Examples
Organization	Acme Corp
Department	Engineering, Operations, Finance, HR
Role	Admin, Developer, Analyst, Viewer
Permission	read:all, write:agents, read:reports, read:public
Resource	Agents, Workflows, Reports, Knowledge, Logs

Permission inheritance flows top-down. Overrides can be applied at any level.

Worked Example

flowchart TD
  ORG[Acme Corp] --> ENG[Engineering]
  ORG --> OPS[Operations]
  ENG --> ADM[Admin role]
  ENG --> DEV[Developer role]
  OPS --> ANA[Analyst role]
  ADM --> P1[read:all, write:agents]
  DEV --> P2[read:reports]
  ANA --> P3[read:reports]

• An Engineering Admin can read everything in Engineering and write to Engineering agents
• A Developer can read reports but not modify agents
• An Operations Analyst can only read Operations reports

How to Configure

1. Define your department hierarchy under organization settings
2. Create roles per department (or reuse organization-wide templates)
3. Grant permissions to each role
4. Assign users to roles (or sync via SSO group claims)
5. Set agent-level overrides for sensitive agents

See SOPs: RBAC Setup for the step-by-step procedure.

Tier Availability

Tier	RBAC
Starter	Not included
Business	Standard
Enterprise	Advanced (matrix across data sources and knowledge)
Custom	Advanced + customized rules

Related

• SSO & Identity for group-claim mapping
• Immutable Audit Logs for permission change tracking