> For the complete documentation index, see [llms.txt](https://docs.trusst.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trusst.ai/trusst-resource-centre/product-guides/user-roles-and-permissions.md).

# User Roles & Permissions

### Access Roles Overview

Trusst AI supports a flexible, role-based access control system to manage user permissions across the platform. Each role grants access to specific features and actions within the application.

Roles must be assigned through your organisation’s identity provider (IDP), such as Okta or Microsoft Entra ID. These roles must be passed to Trusst AI in the `groups` claim of the ID token. The values must match exactly, as shown below.

The supported role keys are:

* **Viewer** (`trusst_ai_viewer`)
* **Evaluator** (`trusst_ai_evaluator`)
* **Prompt Admin** (`trusst_ai_prompt_admin`)
* **AI Agent Admin** (`trusst_ai_agent_admin`)
* **App Admin** (`trusst_ai_app_admin`)

Ensure that users are assigned to one or more of these roles in your IDP, and that the \`groups\` claim is included in the authentication payload.

### Example Authentication Payload

```json
{
  "sub": "idp|ml-ops-9087",
  "name": "Al Gorithm",
  "email": "zero.shot@example.com",
  "groups": [
    "trusstai_viewer",
    "trusstai_prompt_admin"
  ]
}
```

### Role-Based Permissions Table

<table data-header-hidden><thead><tr><th width="110.58984375"></th><th width="246.6015625"></th><th width="79.53125"></th><th width="99.25390625"></th><th width="90.0390625"></th><th width="91.97265625"></th><th width="111.48828125"></th></tr></thead><tbody><tr><td><strong>Feature</strong></td><td><strong>Permission</strong></td><td><strong>Viewer</strong></td><td><strong>Evaluator</strong></td><td><strong>Prompt Admin</strong></td><td><strong>AI Agent Admin</strong></td><td><strong>App Admin</strong></td></tr><tr><td><em>Insights</em></td><td><code>read:insights</code></td><td>✅</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>create:widget</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>delete:widget</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td><em>Import</em></td><td><code>read:imports</code></td><td>✅</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>create:import</code></td><td>🚫</td><td>🚫</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td><em>Contacts</em></td><td><code>read:contacts</code></td><td>✅</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>read:audio-contact</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td><em>Prompts</em></td><td><code>read:prompts</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>create:prompt</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>update:prompt</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>create:publish-prompt</code></td><td>🚫</td><td>🚫</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td><em>Ratings</em></td><td><code>read:ratings</code></td><td>✅</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>create:rating-prompt</code></td><td>🚫</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td><em>Settings</em></td><td><code>read:settings</code></td><td>✅</td><td>✅</td><td>✅</td><td>🚫</td><td>✅</td></tr><tr><td> </td><td><code>update:settings</code></td><td>🚫</td><td>🚫</td><td>🚫</td><td>🚫</td><td>✅</td></tr><tr><td>AI Agents</td><td><code>read:trusstedagent</code></td><td>✅</td><td>🚫</td><td>🚫</td><td>✅</td><td>✅</td></tr><tr><td></td><td><code>create:trusstedagent</code></td><td>🚫</td><td>🚫</td><td>🚫</td><td>✅</td><td>✅</td></tr><tr><td></td><td><code>update:trusstedagent</code></td><td>🚫</td><td>🚫</td><td>🚫</td><td>✅</td><td>✅</td></tr><tr><td></td><td><code>delete:trusstedagent</code></td><td>🚫</td><td>🚫</td><td>🚫</td><td>✅</td><td>✅</td></tr></tbody></table>