Concepts
Roles and permissions
Permissions decide what each role may do with each tool.
Roles come from your directory
Roles map to groups your organisation already manages, so joiners and leavers are handled where they are today. Your directory integration and group mappings are agreed during onboarding.
Three levels of control
| Level | Example |
|---|---|
| Connector | Finance can use the loans system connector; Marketing cannot. |
| Tool | A role can use "look up loan status" but not "export all loans". |
| Action | A role can read a record, but any update needs approval. |
Default is no access
A role sees nothing until access is granted. New tools are added read-only.
Agents
An agent acts with the rights of the person it works for, checked on every action. It never holds more access than that person.
Changing permissions
Your administrator requests a change, your risk owner agrees it, and msharti applies it through the agreed administration process. The change is recorded for review.
// Worked
{ "role": "credit-officer", "connector": "loans", "tool": "get_loan_status", "action": "read", "decision": "allow" }
SAP reconciliation Role check
Amina can read the reconciliation ledger. Posting a change still needs approval.
Same assistant. Different people. Different permissions.