Users & roles

Every person in your workspace has one or more roles. Roles determine what someone can see and do — which documents they can read, whether they can run agent tasks, whether they can approve paused actions, and whether they have admin access. A user with several roles can do anything any of them allow.

As a department admin you can assign roles to people in your department. Platform admins can assign roles workspace-wide.

Assigning a role

Open Administration → Access in the admin console. Roles are listed on the left; pick one to see its members, then add a person from the picker or remove an existing member. Changes take effect the next time the user loads a page — there is no need to ask them to sign out.

Note

Roles that an installed agent needs (for example a “safety officer” role) are created automatically when the agent is enabled — they appear in the list ready for you to add members. Creating the role is automatic; deciding who is in it stays with you.

Service accounts (for integrations)

Some integrations — an external system that feeds events to an agent, or a scheduled job — need to act without a person signing in. A platform admin creates a service account under Administration → Service accounts and issues it an API token (shown once, can be given an expiry, and revoked at any time). The service account’s roles control what it may do, and its actions are attributed to it in the audit log. This is an advanced, integration-time feature — most workspaces won’t need it.

Roles at a glance

Role	What it grants
Employee	Ask questions; read documents at their access level.
Department user	Everything an employee can do, plus run agent tasks and read department-scoped documents.
Approver	Review and decide tasks paused for human approval.
Department admin	Manage users, documents, and settings within their department.
Platform admin	Configure the whole workspace; full access.
Security admin	View the audit log and run access reviews.
Developer	Build and register workflows, tools, and integrations.

For the full role-to-capability matrix, see Roles & permissions.

Document access is separate from roles

Roles control what users can do. What documents they can read is controlled by the document’s access level and department. These two controls work together — a user needs the right role to run a task and the right access level to see the documents that task draws from. See Managing knowledge for how to set document access correctly.

Need more access?

If a user can’t do something you think they should, check their roles first. If the role looks right but they’re still missing information, the issue is likely document access rather than their role. The Troubleshooting & FAQ page covers the most common cases.