Users & Roles

Users & Roles is where access to AgenticObjects is decided. Every member of your company appears here with the roles they hold, the scope each role applies to, and the exact set of actions those roles add up to. Access is granted deliberately and narrowly, and every change can be traced.

What this screen is for

Access is built from two parts: a role, granted at a scope, and optional direct permissions that each open one sensitive capability without granting a whole role. A person's effective access is the sum of the two, and this screen shows it, so you never have to work it out from memory.

The product ships four fixed roles, each including everything the one below it can do:

What you see

1. Users & Roles — the page title, with the principles it follows (Auditability · least privilege) underneath.
2. Scope map — your company, its workspaces and their projects in order. A workspace can carry an LLM or Guardrail badge when it sets its own defaults, and the company node shows how many models its allowlist approves. Counts beside each workspace show its models, agents and connections. Show archived brings archived workspaces and projects back into view, flagged.
3. Add a member — a form with Email and Name, and Create and get the link. After you submit, it shows the Invite link — shown once for you to copy.
4. A card per member — name, email and, for anyone who is not active, a status badge. On the right, Edit name, New sign-in link (for an invite that expired or a forgotten password; single-use, valid for 72 hours, shown only then) and Deactivate — or Reactivate for someone who is not active. Every refused action is written at the top of the page with its reason.
5. Roles — each role the member holds, with its scope (Company, a workspace name, or an agent name) and a Revoke button. Beneath it, the pickers for role, scope and target, and Assign role.
6. Direct permissions — the single permissions granted to this member, each with Revoke, and a picker with Grant to add one.
7. Effective permissions — a collapsible list of every action this member can perform, derived from role bundles plus direct grants.

How to …

Invite a member

1. In Add a member, enter the person's Email and, optionally, their Name.
2. Press Create and get the link.
3. The Invite link — shown once appears beneath the form. Copy it now: it is kept nowhere in readable form, and it can be shown only this once.
4. Pass the link to the person through your own channel — chat, email or in person.
5. They open it, set a password of at least ten characters and sign in. The link works once and for 72 hours.
6. Reload the page: the new member appears in the list without a role. Give them one, as described below, so they can start working.

If the address already belongs to a member, the screen tells you This email is already registered.

Give someone a role

1. Find the member's card.
2. Under Roles, choose the role, then the scope: Company, Workspace or Agent.
3. Pick the workspace or agent the grant applies to.
4. Press Assign role. The card reloads with the new grant listed.

Company scope takes company_admin. Workspace scope takes admin, editor or viewer. An agent-scope grant opens that one agent and nothing else — the right choice for someone who only needs a single agent's answers.

Take a role away

1. Under Roles, press Revoke on the grant.
2. The grant ends immediately. If the person no longer reaches an agent through any other grant, they also stop receiving that agent's briefs.

Grant a single sensitive permission

1. Under Direct permissions, choose one from the picker:
   • view_executed_query — see the exact query behind a number in the evidence layers.
   • run_experiment — run an agent in experiment mode with raised budgets.
   • view_audit_detail — see the full email address typed in failed sign-in attempts in the Audit Log. A company administrator already holds run_experiment and view_audit_detail through the role; a direct grant is for anyone else.
2. Press Grant. Revoke beside it withdraws it again.

Deactivate a member

1. Press Deactivate on the member's card.
2. Their open sessions end at once, their brief deliveries stop, and their effective permissions become empty.
3. Reactivate restores the same person with the same identity; their role grants are still on the card.

Accept an invitation

1. Open the single-use link you were given. The page shows Set your password and the address it is for.
2. Enter a New password of at least ten characters and press Set password.
3. You land on the sign-in page. A link works once and for 72 hours; if it has expired, ask for a new one.

If you forgot your password

1. On the sign-in page press Forgot your password? Request a reset link. and enter your account's e-mail address.
2. If an account exists for that address, a single-use link arrives by e-mail; it is valid for 1 hour. The page never says whether the address is registered.
3. Open the link and enter your password on Set your new password. Every session open with your account ends; you sign in with the new password.
4. Asking again retires the older link; at most three requests an hour are served. If nothing arrives, e-mail may be switched off for your company — contact your administrator.

The administrator's New sign-in link button on a card appears only for people who have not set up their account yet.

How to read it

• Effective permissions is the answer, not the input. It is recalculated from roles and direct grants every time, so it is always what the product will actually allow.
• A higher role always contains the lower ones. An admin never lacks something an editor can do.
• A direct permission never implies a role. It opens exactly one capability and nothing around it.

Good to know

• You can grant and revoke roles only inside scopes your own grants reach — a workspace admin staffs their own workspace and no other.
• The last company admin can never be deactivated or have that role revoked, so your company always keeps someone who can administer it.
• Deactivating is reversible and nothing is ever deleted: the person, their history and their past actions stay on record.
• Losing access takes brief deliveries with it, so no one keeps receiving briefs for an agent they can no longer see.

Related

• Row-level security — narrow which rows a person sees inside a data model
• What an agent can see — how access shapes every answer
• Audit log — the record of who changed what
• Usage & spend — what each person's questions cost
• Agent Studio — where editors build agents