Skip to content
Olympusx AIOlympusx AIOlympusx AI documentation

Roles and permissions

Every person in a tenant holds one role. A role is a set of permissions chosen for a job, so that a person can do theirs without being able to do someone else’s. This page explains the roles and how they are enforced. The page-by-page matrix is in Roles.

The roles

Section titled “The roles”
Role The job In one line
Admin Runs the tenant People and roles, API keys, budgets and deployments, and all a Builder and a Reviewer do.
Builder Makes things Builds, tries and publishes agents, tools, knowledge and assistants. Reads usage, runs and traces.
End user Uses what was published Chats with the assistants the tenant published, and reopens their own conversations.
Reviewer Judges and approves Answers tool calls held for approval, reads conversations and records review judgments.
Auditor Checks Reads everything, including the audit trail, and changes nothing.
Platform admin Runs the platform Holds every permission in every tenant, plus the Platform pages. Not a tenant role.

In the identity provider the End user role is named MEMBER; the other tenant roles are ADMIN, BUILDER, REVIEWER and AUDITOR.

Why they are separated this way

Section titled “Why they are separated this way”
  • The person who builds an agent is not the one who approves its risky calls. A Builder cannot answer approvals; a Reviewer can, and cannot change the agent. An Admin can do both, so a tenant with one person still works.
  • The person who reads the record cannot change it. An Auditor can open every page and export the audit trail, and no request an Auditor sends changes anything.
  • Keys and money stay with the Admin. Builders read budgets and usage; only an Admin issues application keys, sets budgets and deploys models, because each of those commits the tenant’s capacity or spend.
  • People who only use assistants see only assistants. An End user’s console is Overview and My conversations.
  • The tenant’s own budget belongs to the platform. A tenant admin divides the tenant’s budget across projects and keys, and cannot raise it.

How it is enforced

Section titled “How it is enforced”

The control plane decides every request against one table of permissions, before any work is done. The console reads the same table, so it never offers a page, a row or a button the control plane would refuse:

  • a page your role cannot open is not in your rail;
  • a write button your role cannot press is not on the page;
  • a request sent anyway is refused with HTTP 403 and the roles that may do it.

A request whose route has no rule in the table is refused. A signed-in account with no tenant role is refused everything and sees one screen that says so.

A role change takes effect when the person’s session refreshes. The session they already have keeps the old role until then.

API keys are not people

Section titled “API keys are not people”

API keys called against the gateway carry no role. A key is allowed what its project, its model allow-list and its budgets allow. See Keys, budgets and metering.

Section titled “Related”