Permission Hierarchy
The system uses a three-level hierarchy:Permissions
Individual capabilities like
user.edit or role.create. These are system-defined and cannot be modified.Permission Sets
Groups of related permissions (e.g., “User Management” includes
user.view, user.edit, user.delete).Roles
Collections of permission sets assigned to users (e.g., “Admin” role includes multiple permission sets).
System Permissions
All permissions are organized into categories:User Management
user.view- View user list and detailsuser.edit- Modify user roles and permissionsuser.delete- Remove users from the system
Role Management
role.view- View roles and their permission setsrole.create- Create new rolesrole.edit- Modify existing rolesrole.delete- Remove roles
Permission Set Management
permission_set.view- View permission setspermission_set.create- Create custom permission setspermission_set.edit- Modify permission setspermission_set.delete- Remove permission sets
AI/ML Configuration
aiml.view- View AI/ML settingsaiml.edit- Modify model selection, temperature, and safety settings
LLM Provider Management
llm_provider.view- View LLM provider configurationsllm_provider.create- Add new LLM providersllm_provider.edit- Update provider settingsllm_provider.delete- Remove providersllm_provider.test- Test provider connections
Integration Management
integration.view- View integrationsintegration.create- Add new integrationsintegration.edit- Modify integration settingsintegration.delete- Remove integrationsintegration.sync- Trigger manual sync operations
Settings Management
auth.view- View authentication settingsauth.edit- Modify authentication providershistory.view- View configuration historyhistory.rollback- Rollback to previous configurations
Permissions are read-only and cannot be created or modified. They’re defined by the system.
Managing Roles
View All Roles
Navigate to Settings > Roles & Permissions to see all configured roles. The table shows:- Role name
- Description
- Permission sets included in the role
- Actions (Edit, Delete)
Create a New Role
Enter Role Details
Provide:
- Name (required) - A descriptive name like “Report Manager”
- Description (optional) - What this role is for
Select Permission Sets
Check the permission sets this role should include. Each permission set shows:
- Name and description
- Preview of included permissions (first 3)
Edit Existing Role
Changes to roles take effect immediately for all users with that role.
Delete a Role
Confirm Deletion
A confirmation dialog will warn you that users with this role will lose its permissions.
Managing Permission Sets
Permission sets group related permissions together for easier management.View Permission Sets
From Settings > Permission Sets, you can see all available permission sets with their included permissions.Create Custom Permission Set
Enter Details
Provide:
- Code (required) - A unique identifier like
custom_analysts - Name (required) - Display name like “Custom Analysts”
- Description (optional) - What this set is for
Select Permissions
Choose individual permissions to include in this set. Permissions are grouped by category for easier browsing.
Edit Permission Set
You can update the name, description, and included permissions of any custom permission set.System-defined permission sets (like those created during installation) can be viewed but not modified.
Delete Permission Set
Role Assignment Workflow
When assigning permissions to users:Identify Required Permissions
Determine what the user needs to do (e.g., manage integrations, configure AI).
Find or Create Appropriate Role
Check if an existing role provides those permissions. If not, create a new role with the needed permission sets.
Required Permissions
| Action | Permission Required |
|---|---|
| View roles | role.view |
| Create roles | role.create + permission_set.view |
| Edit roles | role.edit + permission_set.view |
| Delete roles | role.delete |
| View permission sets | permission_set.view |
| Create permission sets | permission_set.create |
| Edit permission sets | permission_set.edit |
| Delete permission sets | permission_set.delete |
The UI automatically hides actions you don’t have permission to perform.
Best Practices
Role-Based Design
Design roles around job functions (Admin, Analyst, Viewer) rather than individuals.
Minimal Permission Sets
Keep permission sets focused on specific features or workflows.
Test Before Deploy
Create test roles and verify they grant the expected access before assigning to users.
Document Roles
Use the description field to document what each role is intended for.
Common Role Examples
Administrator
Full system access with all permission sets:- User Management
- Role Management
- Integration Management
- AI/ML Configuration
- Settings Management
Integration Manager
Manage data sources without system access:integration.viewintegration.createintegration.editintegration.sync
AI Configurator
Manage AI settings without user management:aiml.viewaiml.editllm_provider.viewllm_provider.editllm_provider.test
Read-Only Auditor
View-only access to all settings:user.viewrole.viewpermission_set.viewintegration.viewaiml.viewhistory.view