Skip to content

Roles & Permissions

Roles and permissions control what users are authorized to access and perform within AiX.

AiX uses role-based access control to provide users with the capabilities required for their responsibilities while restricting access to functions and resources they do not require.

Authentication determines who the user is.

Roles and permissions determine what the user is allowed to do.

Role-Based Access Control

Role-Based Access Control (RBAC) assigns permissions to roles rather than managing every permission separately for every user.

A simplified model is:

User → Role → Permissions → Actions

For example, a standard user may have permission to use Chat and execute shared Smartflows, while an administrator may have additional permissions to manage users and platform configuration.

Using roles helps organizations apply access controls consistently across groups of users.

Roles

A role represents a collection of permissions associated with a particular responsibility.

Depending on your organization's AiX configuration, roles may be used to distinguish between users who:

  • Use AiX capabilities
  • Create and manage resources
  • Review business activities
  • Approve business activities
  • Manage users and access
  • Configure the platform
  • Perform administrative functions

The roles available to you depend on your AiX version and organizational configuration.

Permissions

Permissions define individual actions that a user is authorized to perform.

Permissions may control activities such as:

  • View
  • Create
  • Modify
  • Delete
  • Execute
  • Share
  • Review
  • Approve
  • Publish
  • Manage

A role can contain multiple permissions.

Users receive the permissions associated with their assigned roles together with any applicable resource-level access controls.

Platform and Resource Access

AiX access can be considered at two levels:

Platform Access

Controls whether a user can access or manage a capability within AiX.

For example, a user may have permission to access Smartflow or administer users.

Resource Access

Controls what the user can do with a particular resource.

For example, a user may have access to one Smartflow but not another.

This separation allows organizations to provide access to a capability without automatically providing access to every resource within that capability.

Resource Roles

AiX resources may use additional roles to control how individual users participate in a particular resource or business process.

Depending on the resource, these may include:

Creator

The Creator is the owner or creator of the resource.

The Creator typically has the permissions required to configure and manage the resource, subject to organizational access policies.

Team

A Team member is a user who has been given access to a shared resource.

Depending on the resource and assigned permissions, Team members may be able to view or use the resource without being permitted to modify its configuration.

Assignee

An Assignee is a user responsible for completing an activity or providing information as part of a business process.

For example, an Assignee may be asked to provide information, upload a document, or submit a response before a Smartflow can continue.

Reviewer

A Reviewer participates in the review stage of a process.

Depending on the workflow configuration, a Reviewer may be able to:

  • Review information
  • Execute an assigned activity
  • Add comments
  • Update review status

A Reviewer does not automatically have approval authority.

Approver

An Approver is authorized to perform an approval activity within a configured business process.

Depending on the workflow, an Approver may review the available information and update the approval status so that the process can continue.

Reviewer and Approver responsibilities should be assigned according to the organization's business controls.

Example

Consider a Smartflow used to review a business document.

The Smartflow may have the following participants:

Creator

Creates, configures, and publishes the Smartflow.

↓

Team

Uses the published Smartflow.

↓

Assignee

Provides the document or information required by the process.

↓

Reviewer

Reviews the AI-generated analysis and provides comments or a review status.

↓

Approver

Performs the required approval action.

These roles allow different responsibilities to be separated within the same business process.

Assigning Roles

Administrators with the appropriate permissions can assign roles to users.

Before assigning a role, consider:

  • The user's business responsibilities
  • The AiX capabilities they require
  • The resources they need to access
  • Whether they need creation or modification rights
  • Whether they require review or approval authority
  • Whether administrative access is required

Users should be assigned only the permissions necessary to perform their responsibilities.

Multiple Roles

A user may have more than one role where required.

For example, a user could be a standard AiX user while also acting as an Approver for a particular Smartflow.

Access is therefore determined by the combination of:

User Identity + Platform Permissions + Resource Access + Process Role

This allows AiX to support different responsibilities without requiring separate user accounts.

Teams and Permissions

Teams can simplify permission management by allowing resources to be shared with groups of users.

For example, instead of sharing a Knowledge Base individually with every member of the Finance department, an administrator or resource owner may provide access to the Finance team.

Users who join or leave the team can then gain or lose the associated resource access according to the configured permissions.

For more information, see Teams.

Permissions and Shared Resources

Resources such as Knowledge Bases, Assistants, and Smartflows may be private or shared.

Sharing a resource does not necessarily give every user permission to modify it.

For example, a user may have permission to:

  • Use an Assistant without editing it
  • Query a Knowledge Base without managing its content
  • Run a Smartflow without modifying its design
  • Review a Smartflow execution without approving it

This separation helps protect shared resources from unauthorized changes.

Least Privilege

AiX administrators should follow the principle of least privilege.

Users should receive only the access required to perform their responsibilities.

For example, a user who only needs to run an existing Smartflow should not require permission to modify or publish that Smartflow.

Similarly, administrative permissions should only be assigned to users responsible for managing the platform.

Separation of Duties

For business processes requiring additional controls, different responsibilities can be assigned to different users.

For example:

Submit → Review → Approve

The user submitting information does not necessarily need permission to approve it.

Similarly, a Reviewer and an Approver can represent separate responsibilities within the process.

Organizations should configure these roles according to their internal governance and business control requirements.

Changing Permissions

User responsibilities may change over time.

Administrators should update roles and permissions when:

  • A user changes department or role
  • Responsibilities change
  • A project ends
  • Temporary access is no longer required
  • Administrative responsibilities change
  • A user leaves the organization

Access changes should follow the organization's identity and access management procedures.

Permission Review

Organizations should periodically review user access.

A review may consider:

  • Active users
  • Assigned roles
  • Administrative privileges
  • Team memberships
  • Shared resource access
  • Reviewer and Approver assignments
  • Users who no longer require access

Regular reviews help ensure that access remains appropriate as organizational responsibilities change.

Audit

Changes to roles, permissions, and resource access are recorded where applicable to support traceability and governance.

Audit information may include:

  • User
  • Action performed
  • Role or permission changed
  • Resource affected
  • Date and time
  • Result of the action

Business activities such as review and approval can also be associated with the user who performed the action.

For more information, see Audit & Activity.

Good Practices

When managing roles and permissions:

  • Follow the principle of least privilege.
  • Use roles rather than assigning permissions individually where possible.
  • Use teams to simplify shared resource access.
  • Keep administrative access limited.
  • Separate submission, review, and approval responsibilities where required.
  • Review access periodically.
  • Remove access when it is no longer required.
  • Avoid shared user accounts.
  • Preserve user identity for auditability.
  • Document organization-specific role definitions and responsibilities.

Refer to the following sections for additional information:

  • Users — Manage AiX user accounts.
  • Teams — Organize users and shared access.
  • Authentication & SSO — Configure how users authenticate.
  • Resource Access — Manage access to Knowledge Bases, Assistants, Smartflows, and other resources.
  • Audit & Activity — Review access changes and user activities.
  • Security — Understand AiX authentication, authorization, and security controls.