Documentation Index
Fetch the complete documentation index at: https://explore.airia.com/llms.txt
Use this file to discover all available pages before exploring further.
Early Access: Custom Roles is rolling out to tenants in stages. If Settings → People & Access does not show Roles and Permissions for your tenant yet, contact your Airia representative for access. This page will be updated as Custom Roles becomes generally available.
Default vs custom roles
Two role types coexist in Settings → People & Access → Roles and Permissions:- Default Roles ship with the product and cannot be edited or deleted. They cover the most common access patterns out of the box.
- Custom Roles are roles you define with your own name, description, and permission set. You can edit, duplicate, and delete them.
| Role | Description |
|---|---|
| Platform Admin | Super administrator with access to all tenants and platform-level operations |
| Admin | Full administrator within a tenant |
| Read-Only Admin | Administrator with read-only access to tenant data |
| Security Admin | Administrator with credential management permissions |
| Project Admin | Project-level administrator with write access to assigned projects only |
| End User | Standard user with basic access |
Create a custom role
Name the role
Enter a Role Name (required). Add a Description to help other admins understand the role’s purpose (optional).
Select permissions
Permissions are grouped by feature area (Catalog, Common, Community, Gateway, Governance, Marketplace, MCP, Security, Settings, and Studio). Expand a group to choose individual permissions, or use the Select all checkbox next to a group to grant it in full. Most permissions offer Manage and Read levels — pick the least-privileged level that does the job. Use the search box to find a permission by name.
Edit a custom role
Open the role's menu
On the Roles and Permissions list, click the ⋯ menu at the end of the custom role’s row and choose Edit Role.
Editing a custom role updates the effective permissions of every user and group it’s assigned to. Changes can take up to 5 minutes to apply to active sessions.
View a Default Role’s permissions
You can’t edit a Default Role, but you can open it to inspect its permission set in read-only mode. Click anywhere on a Default Role’s row in the list, or open its ⋯ menu and choose View Role. To build a role based on a Default Role’s permissions, duplicate it instead (see below).Duplicate a role
Both Default and Custom Roles can be duplicated. Duplicating is the only way to base a new, editable role on a Default Role’s permission set without selecting every permission by hand.Create a project-scoped role
A role created with Add New Role grants its permissions across the entire tenant. To create a role whose access is limited to specific projects — like the built-in Project Admin — you must duplicate an existing project-scoped role rather than starting from scratch.Delete a custom role
A custom role can only be deleted when it is not assigned to any users or groups. Remove it from everyone first, then delete it.Remove all assignments
Reassign the affected users and groups to another role, or remove this role from them, under Settings → People & Access → People.
Assign a custom role
Custom Roles are assigned exactly like Default Roles. Roles can be assigned to both Users and Groups under Settings → People & Access → People — see User Management for the invite and edit flows. When you assign roles, custom and default roles appear together in the same picker.Working with permissions
Permissions are scoped to your tenant — granting a permission applies it across all instances of that resource in the tenant, not to a single item. They are organized into ten feature-area groups; the largest are Settings (admin surfaces), Studio (agent authoring), and Security (guardrails, feeds, and integrations). Because the catalog grows with the product, use the in-product search rather than memorizing the full list.Frequently asked questions
Can I edit a Default Role?
Can I edit a Default Role?
No — Default Roles are immutable. Duplicate one to start from its permission set, then edit the copy.
Can a user have more than one role?
Can a user have more than one role?
Yes. A user’s effective permissions are the union of all roles assigned to them, plus any roles inherited from their groups.
Can I delete a role that's assigned to users?
Can I delete a role that's assigned to users?
No. A role must be removed from all users and groups before it can be deleted — otherwise the deletion fails. Reassign affected users to another role first.
Can I share, import, or export roles across tenants?
Can I share, import, or export roles across tenants?
How long until a role change takes effect?
How long until a role change takes effect?
Up to 5 minutes for active sessions.