User roles¶
Status: Current | Last reviewed: 2026-10-07
Your access level determines what you can do in Agent Studio. Agents include voice agents, chat agents, copilots, translation agents and background workflows. The same access rules apply to every agent type.
Access levels¶
| Level | Scope | What you can do |
|---|---|---|
| Platform Admin | Every tenant | All operations, including tenant creation, platform user administration and assigning Platform Admin access. Switch tenants to work with their agents and configuration. |
| Admin | Assigned tenant | All tenant operations: build and run agents, manage tools and configuration, and add, change or remove tenant memberships. |
| Builder | Assigned tenant | Browse, create, edit, publish, clone, import, export, delete and run agents of every type. Manage tools, catalogs and multimodal surfaces. |
| Viewer | Assigned tenant | Browse and run existing agents, including testing saved draft or published versions, and inspect conversations and execution results. |
Viewer cannot create or edit definitions, publish, delete, change tools, or manage tenant configuration. Builder cannot administer tenant membership, configuration or platform users. Role assignments can differ between tenants.
Assigning access¶
- Platform Admin: open the profile menu → Admin → Tenants → Members. Add an existing user and choose Admin, Builder or Viewer. Use Admin → Users to create a user or grant/revoke Platform Admin status.
- Tenant Admin: open Settings → Access → Members to add an existing user, change their tenant role, or remove their membership in your selected tenant.
- Identity-provider administrator: assign an Authentik group named
tenant:<tenant-slug>:<role>, usingadmin,builderorviewer. Platform Admin uses the separatetrueserve-platform-admingroup.
Membership changes in Agent Studio update Authentik first and then TrueServe. Identity-provider-only changes are imported on the next SSO sign-in. Refresh Agent Studio after a role change to update visible controls. Authentik write-back must be configured for membership changes in the app.
Existing assignments¶
Existing Developer assignments resolve to Builder, Operator to Admin, and Analyst to Viewer. Existing Viewer groups now grant browse/run access. Old SSO group names continue to work during migration; new assignments use the current names.
Access is determined by your assigned role. Retired custom permission grants cannot give Viewer authoring access or give Builder tenant administration. Profile Settings shows your effective access.
Profile settings¶
Open Profile → Settings to view your identity, active tenant, roles and effective permissions. These fields are read-only. Every authenticated tenant user can create a Personal Access Token; it follows their current tenant access. A Viewer's token can run agents but cannot create or edit them.
See also¶
Instance and tenant access¶
On a managed instance, use https://access.trueserve.deloitte.com to assign a specific Studio instance and tenants within it. Tenant Admin applies to one tenant; Instance Admin applies to every tenant in this instance. Suspension keeps assignments. Reductions end local sessions and revoke API tokens in this instance. Existing legacy roles and custom permissions are retained during migration. Read-Only is offered only when the deployed Studio role model supports it; older Analyst roles can edit agents and workflows.