Skip to main content

Roles & permissions

Admin

Ask uses role-based access control: two built-in roles cover the common cases, and admins can define custom roles with per-permission toggles under People & Access → Access → Custom roles.

Built-in roles​

  • Member: the default. Chat with agents, create personal knowledge collections, use shared agents and tools, and manage their own Personal settings (profile, tool permissions, API keys).
  • Organization Administrator: everything a Member can do, plus the organization sections of Settings: People & Access, Data, Capabilities, and Account.

Both built-in roles are locked: you can't edit their permissions.

Custom roles​

  1. Open Settings → People & Access → Access and click the Custom roles row.

    User roles dialog listing built-in and custom roles
    The User roles dialog. Built-in roles show a lock; custom roles are editable.

  2. Click + Add a new role type (or the pencil next to an existing custom role).

  3. Name the role and switch on only the permissions it needs, then Save.

    Edit role type dialog with permission toggles
    Each role is a set of permission toggles across two groups.

The permission list​

GroupPermissions
Content permissionsBuild connectors · Manage agents · Manage collections · Manage connectors · Manage database connections · View and use agents · View connectors · View database connections
App configurationEval admin access · Eval member access · Manage API keys · Manage SMTP config · Manage triggers · Manage user groups · Manage users · View feedback and reporting
Least privilege, role edition

Custom roles let you split admin duties, e.g. a "User manager" with only Manage users and Manage user groups, or a "Builder" with the content permissions but no app configuration. Start from nothing and add.

Assign a role​

  1. Open People & Access → Users.

  2. Use the Role dropdown on the user's row and pick the new role. The change takes effect on the user's next request.

Default role for new users​

The Default user role setting on the Access tab controls which role users get when they sign in via SSO for the first time (just-in-time provisioning). It defaults to Member.

Resource-level sharing​

Roles set the floor; per-resource sharing fills in the rest. Agents and knowledge collections are shared individually with users or groups. See Share & discover and Organize & manage.

AdminManage usersInvite teammates and assign these roles.AdminSecurityThe Access tab where custom roles live.APIAPI keysPer-key permissions are separate from, and capped by, your role.