AgentBrain SOP

Appearance

SOP: RBAC Setup ​

Goal ​

Establish a working RBAC model that maps the organization's structure to AgentBrain roles, scoped permissions, and SSO group claims.

Prerequisites ​

  • Business tier or above
  • Admin role on AgentBrain
  • SSO configured if you plan to map roles from IdP group claims
  • A finalized list of departments and the roles that exist in each

Steps ​

1. Define the department hierarchy ​

In Settings → Organization → Departments:

  • Add each department your organization needs (Engineering, Operations, Finance, HR, Customer Support, etc.)
  • Confirm the inheritance order: organization-level roles cascade down to department-level

2. Create roles per department ​

For each department:

  • Identify the roles that exist (Admin, Developer, Analyst, Viewer is a sensible default)
  • Create the role in Settings → RBAC → Roles

3. Assign permissions ​

For each role, grant permissions across resources:

ResourcePermission verbs
Agentsread, write, invoke
Workflowsread, write, run
Knowledge collectionsread, write, manage
Reportsread
Logsread, export
RBACgrant, revoke

Start narrow and widen as users request. The default deny is the safer baseline.

4. Map SSO group claims to roles ​

In Settings → SSO → Group Mapping:

  • For each IdP group, choose the AgentBrain role to assign
  • Save and test: log in as a user in that group and confirm the role is granted

5. Set agent-level overrides ​

For sensitive agents (financial actions, customer data write, admin tooling):

  • Open the agent definition
  • Add explicit role grants under "Restricted Access"
  • Save: only listed roles can invoke

6. Verify with non-admin users ​

  • Have a Developer-role user attempt actions they should and should not be able to do
  • Confirm the audit log shows the allowed actions and rejects the disallowed ones with a clear error

Verification ​

  • Audit log shows expected role.grant, agent.invoke, and permission.deny entries
  • Non-admin users see only the agents, knowledge, and workflows they have access to

Rollback ​

  • Revoke any incorrect role grants from Settings → RBAC → Roles
  • Remove SSO group mappings if a mapping caused unintended escalation