👥User Roles & Permissions

Role-based access for controlling feature-level permissions via your organisation’s IDP.

Access Roles Overview

Trusst AI supports a flexible, role-based access control system to manage user permissions across the platform. Each role grants access to specific features and actions within the application.

Roles must be assigned through your organisation’s identity provider (IDP), such as Okta or Microsoft Entra ID. These roles must be passed to Trusst AI in the groups claim of the ID token. The values must match exactly, as shown below.

The supported role keys are:

• Viewer (trusst_ai_viewer)

• Evaluator (trusst_ai_evaluator)

• Prompt Admin (trusst_ai_prompt_admin)

• AI Agent Admin (trusst_ai_agent_admin)

• App Admin (trusst_ai_app_admin)

Ensure that users are assigned to one or more of these roles in your IDP, and that the `groups` claim is included in the authentication payload.

Example Authentication Payload

{
  "sub": "idp|ml-ops-9087",
  "name": "Al Gorithm",
  "email": "[e-mail]",
  "groups": [
    "trusstai_viewer",
    "trusstai_prompt_admin"
  ]
}

Role-Based Permissions Table

Feature	Permission	Viewer	Evaluator	Prompt Admin	AI Agent Admin	App Admin
Insights	read:insights	✅	✅	✅	🚫	✅
	create:widget	🚫	✅	✅	🚫	✅
	delete:widget	🚫	✅	✅	🚫	✅
Import	read:imports	✅	✅	✅	🚫	✅
	create:import	🚫	🚫	✅	🚫	✅
Contacts	read:contacts	✅	✅	✅	🚫	✅
	read:audio-contact	🚫	✅	✅	🚫	✅
Prompts	read:prompts	🚫	✅	✅	🚫	✅
	create:prompt	🚫	✅	✅	🚫	✅
	update:prompt	🚫	✅	✅	🚫	✅
	create:publish-prompt	🚫	🚫	✅	🚫	✅
Ratings	read:ratings	🚫	✅	✅	🚫	✅
	create:rating-prompt	✅	✅	✅	🚫	✅
Settings	read:settings	✅	✅	✅	🚫	✅
	update:settings	🚫	🚫	🚫	🚫	✅
AI Agents	read:trusstedagent	✅	🚫	🚫	✅	✅
	create:trusstedagent	🚫	🚫	🚫	✅	✅
	update:trusstedagent	🚫	🚫	🚫	✅	✅
	delete:trusstedagent	🚫	🚫	🚫	✅	✅