Role guides and access boundaries
Reading paths
Tenant owner
Provision local users and workspace policy, publish evaluation configuration, configure sources/models and supervise quality. Owner-gated settings require the owner role, even when a manager has many equivalent permissions. Tenant owner does not imply platform-console operator access.
Recommended path: ACC-01 → ACC-02 → ACC-05 → ACC-07 → ACC-08 → ACC-09 → OPS-01 → OPS-02 → OPS-05 → XFN-02.
Manager
Allocate reviews, resolve disputes, distribute/finalise group calibration, manage coaching/training and measure improvements. Connector mutations and owner-only settings remain owner-gated.
Recommended path: INS-01 → QMS-01 → QMS-05 → QMS-06 → QMS-08 → QMS-09 → QMS-10 → QMS-12 → LRN-03 → LRN-05 → LRN-06 → JNY-05.
Reviewer
Complete your assigned reviews, calibrations and independent re-reviews. Reviewer ownership is enforced; audit-trail access does not expose other reviewers’ private draft answers. Assigned-coach API updates may be available, but the local coaching page has an access mismatch (GAP-01).
Recommended path: ACC-01 → QMS-01 → QMS-02 → QMS-03 → QMS-04 → QMS-06 → QMS-07 → QMS-11 → INS-08.
Agent
Use permitted ingestion/evidence features, read published knowledge and complete personal learning. Personal coaching milestone and live-assist UI handoffs are incomplete for local agents (GAP-01/02); role permission alone must not be described as a working navigation path.
Recommended path: ACC-01 → ACC-10 → INT-01 → INT-02 → INT-04 → INT-05 → KNO-01 → LRN-01 → LRN-04 → LRN-07.
Viewer
Read permitted operational/knowledge records and personal learning where assigned. qms:read includes some APIs with writes to personal progress/views; viewer is not a universal database read-only guarantee. Intelligence navigation and management workflows remain restricted.
Recommended path: ACC-01 → ACC-10 → INT-01 → KNO-01 → LRN-01 → LRN-04 → INS-01.
Platform administrator/operator
Use the separate platform login to maintain tenants, system models/prices/budgets, transcriber policy and platform quality review. A platform:admin principal can satisfy many tenant permission middleware checks but is distinct from a provisioned platform operator session.
Recommended path: OPS-07 → OPS-08 → OPS-09 → ASK-03 → OPS-10.
Technical operator/integration maintainer
Operate ingestion, callbacks, queues, recovery and retention using the service-specific authentication boundary. “Technical operator” is a responsibility, not a built-in tenant role; obtain the exact tenant/platform/infrastructure access required for each action.
Recommended path: OPS-01 → OPS-02 → OPS-03 → OPS-04 → INT-03 → INT-06 → INT-07 → INT-08 → INT-11 → OPS-10 → OPS-11 → OPS-12.
Default local-role permission matrix
This matrix comes from localRolePermissions in services/api/src/identity/authenticator.ts. It describes local accounts. Auth0 principals use validated token permissions; do not infer equivalent grants from a role label. The development authenticator can grant broad explicit permissions and is unsuitable for verifying real local-role restrictions.
| Permission | Owner | Manager | Reviewer | Agent | Viewer |
|---|---|---|---|---|---|
qms:read | Yes | Yes | Yes | Yes | Yes |
interactions:write | Yes | Yes | — | Yes | — |
artifacts:write | Yes | Yes | Yes | Yes | — |
scorecards:write | Yes | Yes | — | — | — |
scorecards:publish | Yes | Yes | — | — | — |
scorecards:assign | Yes | Yes | — | — | — |
audits:review | Yes | Yes | Yes | — | — |
audits:manage | Yes | Yes | — | — | — |
calibrations:review | Yes | Yes | Yes | — | — |
calibrations:manage | Yes | Yes | — | — | — |
calibrations:adjudicate | Yes | Yes | — | — | — |
re_reviews:review | Yes | Yes | Yes | — | — |
audit-trail:read | Yes | Yes | Yes | — | — |
knowledge:write | Yes | Yes | — | — | — |
knowledge:publish | Yes | Yes | — | — | — |
members:read | Yes | Yes | Yes | Yes | Yes |
members:manage | Yes | Yes | — | — | — |
teams:read | Yes | Yes | Yes | — | — |
teams:manage | Yes | Yes | — | — | — |
alerts:read | Yes | Yes | — | — | — |
alerts:manage | Yes | Yes | — | — | — |
operations:manage | Yes | Yes | — | — | — |
molecules:manage | Yes | Yes | — | — | — |
reports:manage | Yes | Yes | — | — | — |
usage:read | Yes | Yes | — | — | — |
integrations:manage | Yes | Yes | — | — | — |
ask:quality:review | Yes | Yes | — | — | — |
transcriptions:manage | Yes | Yes | — | — | — |
platform:admin | — | — | — | — | — |
UI and server checks must both pass
| Surface | Local UI gate | Server boundary / effect |
|---|---|---|
| Users / teams / companies | members:manage / teams:manage | Member/team APIs apply their own read/manage and owner safeguards. |
| Workspace | members:manage | Retention, timezone, transcription and several feature settings are owner-gated; review-assignment uses audits:manage. |
| LLM connections, usage, pricing, LLM testing | Owner or platform override | Some list/usage APIs accept members:manage or usage:read; this does not imply UI access. |
| Intelligence paths, coaching, reports library/insights, journeys, AI learning and live assist | alerts:read or platform override, through canAccessIntelligence in local mode | Several backing APIs accept qms:read, own-record access or another permission; see GAP-01/02/07. |
| Ask quality review | ask:quality:review plus Ask client gate | Server Ask enablement, quality scope and opt-in/expiry checks also apply. |
| AI learning | ask:quality:review OR audits:manage, plus intelligence gate | Same review permission alternatives, with tenant scope. |
| Transcription list/review | transcriptions:manage | Individual associated job detail can be qms:read; approval/cancel remain privileged. |
| Integration settings | integrations:manage | Generic credential lifecycle uses this permission; most provider connector mutations additionally require owner. |
| Platform console | Separate platform authentication | Operator session and endpoint-specific validation; tenant owner role is insufficient. |
These local web rules are in apps/web/src/app.tsx. Permission middleware/owner override is in services/api/src/identity/access.ts. Object ownership, independence, tenant membership, feature gates and lifecycle state still apply after a permission check succeeds. Source-specific checks appear in each workflow and API coverage row.