> ## Documentation Index
> Fetch the complete documentation index at: https://explore.airia.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Permissions Reference
> What each permission controls in the Custom Roles builder, organized by feature area.
When you build a [Custom Role](/admin-hub/account_settings/custom-roles), you grant access by selecting individual **permissions**. This page documents what each permission controls so you can pick the least-privileged set that does the job.
In the role builder, permissions are organized as **feature area → capability → access level**:
* **Feature area** — the top-level group (Studio, Settings, Security, …).
* **Capability** — a specific feature within that area (for example *Users*, *Guardrails*, *Models*).
* **Access level** — what you can do with it. The common levels are:
* **Read** — view only.
* **Manage** — full write access (create, update, and delete).
* **Browse** / **View page** — open the feature's page or area in the UI, with no data changes.
* A few areas use finer levels — for example **Budgets** uses **All / Project / Your own** scopes.
A user's effective permissions are the **union** of every role assigned to them, directly or inherited from a group.
If a permission described here doesn't appear in your role builder, it's tied to a feature that isn't enabled for your account yet. Contact your Airia representative if you need it.
## Studio
Building, deploying, and operating agents, models, tools, data sources, and related Studio assets.
| Capability | Level | What it grants |
| ------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Administration | Read | Access the System Agents settings — view system agents, enable/disable them, configure overrides, and pin/unpin versions (this single permission gates the whole System Agents area, including changes) |
| Agents | Read | List/view agents |
| Agents | Manage | Create, update, delete, execute, deploy, export, and version agents, and view feedback and requests |
| Assistants | Read | View assistants |
| Assistants | Manage | Create, update, and delete assistants |
| Attachments | Read | View/refresh attachment URLs |
| Attachments | Manage | Upload and delete attachments |
| Code Steps | Execute | Execute code steps in agents |
| Dashboard | Read | View usage dashboard, top agents, models, and tools |
| Data Sources / Connectors | Read | View data sources |
| Data Sources / Connectors | Manage | Create, update, and delete data sources |
| Deployments | Read | View agent deployment interfaces |
| Deployments | Manage | Manage agent deployment interfaces |
| Evaluations | Read | View evaluations |
| Evaluations | Manage | Create, clone, and delete evaluations |
| Execution Logs | Read | View agent execution logs |
| Execution Logs | Manage | Delete agent execution logs |
| Feeds | Consumption / Conversation / Execution / Gateway / Ingestion / Processing | View the corresponding activity and monitoring feed |
| Insights | Read | View insights dashboard |
| Jobs | Read | View batch agent runs (e.g. running an agent over every row of a CSV or file in a data source) and their results |
| Jobs | Manage | Create, run, retry, cancel, and delete batch agent runs |
| Knowledge Graphs | Read | View knowledge graphs |
| Knowledge Graphs | Manage | Create, update, and delete knowledge graphs |
| Knowledge Extraction | Manage | Create, update, and delete the entity types (industry presets) used to extract entities during knowledge/graph ingestion |
| MCP Servers | Read | View MCP servers available to attach to agents as tools |
| MCP Servers | Manage | Create, update, and delete MCP servers used as agent tools |
| Memories | Read | View memories |
| Memories | Manage | Create, update, and delete memories |
| Models | Read | View available models |
| Models | Manage | Add, update, and remove models |
| Model Deprecation | Read | View model deprecation banners |
| Model Deprecation | Manage | Dismiss banners and bulk replace deprecated models |
| Projects | Read | List/view projects |
| Projects | Manage | Create, update, delete, pin/unpin, and archive projects |
| Prompts | Read | View reusable prompt templates used when building agents |
| Prompts | Manage | Create, update, and delete reusable prompt templates |
| Schedules | Read | View deployment schedules |
| Schedules | Manage | Create, update, and delete deployment schedules |
| Skills | Read | Browse skills page and view skills repositories |
| Skills | Manage | Create, update, and delete skills repositories |
| Smart Scan | Read | View smart scans |
| Smart Scan | Manage | Create, update, delete, and execute (retry/cancel) smart scans |
| Smart Scan Templates | Read | View Smart Scan template groups |
| Smart Scan Templates | Manage | Create and delete Smart Scan template groups |
| Tools | Read | View tools |
| Tools | Manage | Create, update, and delete tools |
| User Prompts | Read | View prompts saved by individual users |
| User Prompts | Manage | Create, update, and delete prompts saved by individual users |
| User Tasks | Read | Browse routines page and view user tasks and routines |
| User Tasks | Manage | Create, update, and delete user tasks and routines |
## Gateway
AI Gateway and MCP Gateway configuration, monitoring, swarm, and resilience.
| Capability | Level | What it grants |
| ---------------------- | -------- | ------------------------------------------------------------------- |
| AI Gateway | Read | View AI gateway configs |
| AI Gateway | Read All | View all AI gateway configs across the account |
| AI Gateway | API Keys | Manage gateway API keys |
| AI Gateway | Manage | Create, update, delete gateway configs, and manage gateway API keys |
| MCP Gateway | Read | View MCP gateway list |
| MCP Gateway | Manage | Create, update, and delete MCP gateway servers |
| MCP Monitoring | Read | View MCP monitoring |
| Analytics / Monitoring | Read | View gateway monitoring |
| Resilience Rules | Read | View resilience rules |
| Resilience Rules | Manage | Create, update, and delete resilience rules |
| Swarm Management | Read | View swarm config |
| Swarm Management | Manage | Create, update, and delete swarm config |
## Catalog
End-user catalog surfaces: chat spaces and enterprise search.
| Capability | Level | What it grants |
| ----------------- | ------ | ---------------------------------------------------------------- |
| Enterprise Search | Read | Use enterprise search to find files across data store connectors |
| Chat Spaces | Read | View chat spaces |
| Chat Spaces | Manage | Create and update chat spaces |
**Enterprise Search appears in two places:** this **Catalog** permission grants the end-user *search experience* (finding files across connectors). The **Settings → Enterprise Search** permission grants the *admin configuration* of that feature (connecting data sources, deploying the integration).
## Common
Cross-cutting capabilities every user touches: profile, conversations, artifacts, files, voice, and agent execution.
| Capability | Level | What it grants |
| ------------------- | ------- | ------------------------------------------------------- |
| Agents | Execute | Execute an agent (run a chat turn or job) |
| Artifacts | Read | View artifacts |
| Artifacts | Manage | Create and update artifacts |
| Conversations | Manage | Create, update, and delete conversations |
| Document Generation | Manage | Generate, convert, and process documents |
| OAuth Providers | Read | View own OAuth provider connection status |
| OAuth Providers | Manage | Authorize OAuth provider for user account |
| Profile | Read | View own profile |
| Profile | Manage | Update own profile |
| Roles | Read | View available roles |
| Text-to-Speech | Manage | Synthesize text to speech |
| User Files | Read | List and download user store files |
| User Files | Manage | Upload, rename, and delete user store files and folders |
| Voice Chat | Manage | Create voice chat sessions |
**Roles → Read is managed automatically for custom roles.** Airia adds and locks this permission on any custom role that grants admin-level permissions — which makes the role **admin-tier**, so its assigned users land on the admin home page instead of the chat/catalog experience. End-user-tier roles (only end-user-level permissions) don't receive it. You don't grant it by hand; a role's tier follows the permissions you select. See [Mandatory baseline permissions](/admin-hub/account_settings/custom-roles#mandatory-baseline-permissions) for the permissions every custom role is required to hold.
## Governance
AI governance: use cases, assessments, risk registry, frameworks, workflows, disclosures, and AI-asset inventory.
| Capability | Level | What it grants |
| ------------------- | ------ | ----------------------------------------------------- |
| AI Assets | Read | View AI assets |
| AI Assets | Manage | Create, update, and delete AI assets |
| AI Asset Metadata | Read | View AI asset metadata |
| AI Asset Metadata | Manage | Create, update, and delete AI asset metadata |
| Assessments | Read | View assessments |
| Assessments | Manage | Create, update, and delete assessments |
| Dashboard | Read | View governance dashboard |
| Disclosures | Read | View disclosures |
| Disclosures | Manage | Create, update, and delete disclosures |
| Frameworks | Read | View governance frameworks |
| Frameworks | Manage | Create, update, and delete governance frameworks |
| Risk Registry | Read | View risk registry |
| Risk Registry | Manage | Create, update, and delete risk entries |
| Governance Settings | Read | View governance settings |
| Governance Settings | Manage | Update governance settings and approver configuration |
| Use Cases | Read | View use cases |
| Use Cases | Manage | Create, update, and delete use cases |
| Workflows | Read | View governance workflows |
| Workflows | Manage | Create, update, and delete governance workflows |
## Security
Security and compliance: guardrails, constraints, red teaming, posture management, SASE, code scanning, the AI app catalog, and audit-entry suppression.
| Capability | Level | What it grants |
| --------------------------- | ----------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| AI App Catalog | Read | View AI app catalog |
| AI App Catalog | Manage | Block/unblock AI apps |
| Audit | Read | View suppressed audit entries |
| Audit | Manage | Suppress audit log entries |
| Security Center | Read | View security center |
| Security Center | Manage | Manage security center configuration |
| Code Scanner | Read | View scan results |
| Code Scanner | Manage | Execute scans |
| Agent Constraints | Read | View constraints |
| Agent Constraints | Manage | Create, update, and delete constraints |
| Endpoint Agent Policies | Manage | Manage endpoint agent security policies |
| Feeds | Cloudflare / Constraints / DLP / Events / Integration / Responsible AI / Violations | View the corresponding security monitoring feed |
| Guardrails | View page | Open the Guardrails page |
| Guardrails | Read | View guardrails |
| Guardrails | Manage | Create, update, and delete guardrails |
| Red Teaming | Read | View red team campaigns |
| Red Teaming | Manage | Create, delete, evaluate campaigns, and view/generate datasets |
| SASE Integration | Read | View Shadow AI configs |
| SASE Integration | Manage | Create, update, and delete Shadow AI configs |
| Security Posture Management | Read | View SPM dashboard |
| Security Posture Management | Manage | Create, update, delete, refresh, and connect SPM configs |
**Security → Audit** controls audit-entry **suppression** (hiding entries from the audit log). To let a role *view* the account system log instead, use **Settings → System Log → Read**.
## Community
Private community library: agents, submissions, memberships, invite codes, contributors, and sharing.
| Capability | Level | What it grants |
| ------------ | ------ | ------------------------------------------------------------------------------------ |
| Agents | Read | Browse the agent catalog in communities |
| Communities | Read | Browse private communities page and list/view communities the account is a member of |
| Communities | Manage | Create, update, and delete communities |
| Contributors | Read | View community contributors |
| Contributors | Manage | Update community contributors |
| Invite Codes | Read | View community invite codes |
| Invite Codes | Manage | Create and revoke community invite codes |
| Memberships | Read | View member lists in communities |
| Memberships | Manage | Invite accounts, revoke, change roles, and accept/decline invites |
| Sharing | Read | Share agents and resources with the community |
| Submissions | Read | View community submissions |
| Submissions | Review | Approve or reject submissions |
| Submissions | Manage | Create, submit, review, approve, reject, and update submissions |
| Users | Read | View community users |
| Users | Manage | Create, update, and delete community users |
## Marketplace
Marketplace library, billing/subscriptions, and transactions.
| Capability | Level | What it grants |
| ------------ | --------- | ---------------------------------------------------------------- |
| Billing | Read | View billing portal and subscription info |
| Billing | Subscribe | Start a new subscription / service-pack checkout via the paywall |
| Billing | Manage | Create payments and checkout sessions |
| Library | Read | View marketplace library (models, agents, prompts) |
| Transactions | Read | View financial transactions and receipts |
## MCP
Model Context Protocol gateway: servers, analytics, and tenant access.
| Capability | Level | What it grants |
| ------------- | ------ | --------------------------------------------------------------------- |
| Analytics | Read | View MCP analytics and usage |
| Servers | Read | Browse the custom remote MCP servers page and view individual servers |
| Servers | Manage | Create, update, and delete custom remote MCP servers |
| Tenant Access | Manage | Manage tenant server access |
**Three MCP surfaces, three permission groups:** *Studio → MCP Servers* (`Studio` area above) attaches MCP servers to agents as tools; *Gateway → MCP Gateway* (`Gateway` area) is the hosted gateway that proxies and secures MCP traffic account-wide; *MCP → Servers* (here) registers the individual custom remote MCP servers exposed through that gateway.
## Budgets
Budget management — viewing and updating company, project, and personal budgets.
| Capability | Level | What it grants |
| --------------- | ------ | ------------------------------------------------------ |
| All budgets | Browse | Navigate through budget management views |
| All budgets | Read | Read all budgets: company, project, user, or gateway |
| All budgets | Update | Update all budgets: company, project, user, or gateway |
| Project budgets | Read | Read budgets for projects you belong to |
| Project budgets | Update | Update budgets for projects you belong to |
| Your own budget | Read | Read your own budget |
| Your own budget | Update | Update your own budget |
## Settings
Organization administration: users, groups, SSO/SCIM, credentials, API keys, branding, data retention, and other account settings.
| Capability | Level | What it grants |
| -------------------------- | --------- | ------------------------------------------------------------------------------------------------------- |
| Account Settings | Read | View account info |
| Account Settings | Manage | Update account settings |
| Airia Agent | View page | Open the Airia Agent settings page |
| API Keys | Read | List/view API keys |
| API Keys | Manage | Create, update, delete, and generate API keys and view key scopes |
| Branding | View page | Open the Branding settings page |
| Branding | Read | View branding config |
| Branding | Manage | Create, update, and delete branding |
| Build with AI | Read | View Build with AI config |
| Build with AI | Manage | Update Build with AI config |
| Classifications | View page | Open the Classifications settings page |
| Classifications | Read | View classifications |
| Classifications | Manage | Create, update, and delete classifications |
| Cloud Connector | Read | View connected accounts |
| Cloud Connector | Manage | Configure connector groups |
| Credentials | View page | Open the Credentials settings page |
| Credentials | Read | List/view stored credentials (provider API keys, OAuth tokens, passwords) |
| Credentials | Manage | Create, update, and delete stored credentials |
| Custom Credentials | View page | Open the Custom Credentials settings page |
| Custom Credentials | Read | List/view custom-type credentials (admin-defined fields, e.g. an API key sent as an HTTP header) |
| Custom Credentials | Manage | Create, update, and delete custom-type credentials |
| Data Retention | Read | View retention settings |
| Data Retention | Manage | Update retention settings |
| Departments | View page | Open the Departments settings page |
| Departments | Read | List departments |
| Departments | Manage | Create, update, delete, and reorder departments |
| Enterprise Search | Read | View search config |
| Enterprise Search | Manage | Update enterprise search config |
| Extensions | Read | View extensions |
| Extensions | Manage | Create, update, and delete extensions |
| External Identity Provider | Read | View external IDP config |
| External Identity Provider | Manage | Save and validate external IDP config |
| External Monitoring | Read | View external observability (OpenTelemetry) monitoring data |
| Groups | Read | List/view groups |
| Groups | Manage | Create, update, delete, and bulk re-invite groups |
| Impersonation | Read | View the user impersonation tool |
| Impersonation | Manage | Generate impersonation tokens |
| License Keys | View page | Open the License Keys settings page |
| License Keys | Read | List license keys |
| License Keys | Manage | Add and delete license keys |
| Meetings | View page | Open the Meetings settings page |
| Meetings | Read | View meeting config |
| Meetings | Manage | Create, update, and delete meeting configs |
| Notifications | Read | Browse notifications page and view alerts and notification subscriptions |
| Notifications | Manage | Send, update, and close/archive notifications and alerts |
| OAuth Connectors | View page | Open the OAuth Connectors settings page |
| OAuth Connectors | Read | View OAuth connectors |
| OAuth Connectors | Manage | Create, update, and delete OAuth connectors |
| Omni Agent | Read | View Omni Agent configuration |
| Omni Agent | Manage | Update Omni Agent configuration |
| People | View page | Open the People page |
| Rate Limits | Read | View rate limits |
| Rate Limits | Manage | Update rate limits |
| SIEM | Read | View SIEM settings |
| SIEM | Manage | Update SIEM settings |
| SSO / Identity Providers | Read | View SSO configuration |
| SSO / Identity Providers | Manage | Add, update, delete, import identity providers, and generate SCIM tokens |
| System Log | Read | View the account system log |
| Tenant Images | Read | View tenant images |
| Tenant Images | Manage | Upload and delete tenant images |
| Tenant Metrics | Read | View tenant metrics |
| Tool Efficiency | Read | View tool efficiency dashboard |
| Users | Read | List/view users |
| Users | Manage | Create, update, delete, re-invite users, assign roles/groups, reset passwords, and run batch operations |
| User Sync | Manage | Sync users and groups |
| Webhooks | Read | List/view webhooks |
| Webhooks | Manage | Create, update, and delete webhooks |
Looking for how to create, edit, duplicate, or assign roles? See [Custom Roles](/admin-hub/account_settings/custom-roles).