RBAC Roles

Roles are Evose's starting granularity for permissions. A user can have multiple roles, and permissions are the union.

Built-in Roles

Role	Permissions
System administrator	All — assign carefully
Default role	The org can customize the default permission set
Read-only role	View only, no changes

Custom Roles

Organizations can create any role, e.g.:

Example	Use
New hire	Restricted permissions; joining a workspace requires approval
Partner	Access to specified workspaces only
App builder	Cross-workspace Agent / Workflow editing rights
Finance audit	Org-wide read-only + observability

Three Permission Tiers

Permissions stack in three layers, precision increases top-down:

Layer A · System-level
  ├─ Tool management (register/edit/delete org tools)
  ├─ Model management
  ├─ Deployment management
  └─ Policy management

Layer B · Workspace-level
  ├─ View resources in this workspace
  ├─ Edit resources in this workspace
  └─ Use apps published in this workspace

Layer C · Resource-level ACL
  └─ Fine-grained authorization on individual Agent / Workflow / KB

→ Resource policy ACL governs Layer C

Multi-Role Union

A user can have multiple roles simultaneously:

Alice
├─ Role: Marketing team member       → Edit access in Marketing workspace
├─ Role: CS workspace user           → Use access in CS workspace
└─ Role: Org-wide data observer      → Read-only across all workspaces

Permissions are OR (union): any role allowing = allowed.

Permission Conflicts

When RBAC and resource ACL conflict, ACL wins. Example:

Role "Marketing edit" allows editing Agent A
Agent A's ACL explicitly denies Alice

→ Alice cannot edit Agent A.

Role Lifecycle

Action	Who
Create role	Org admin
Edit permissions	Org admin
Add members	Org admin
Delete role	Org admin

Deleting a role = its members lose those permissions

Migrate members to other roles first, then delete.

Tie-In with Member Management

Members & departments maintains the directory; roles are referenced there:

Members
├─ Alice  email  Dept: Marketing  Roles: Marketing editor + Data observer
├─ Bob    email  Dept: R&D        Roles: App builder
└─ ...

Next Steps

Configure resource policies → Resource policy
Refine inside a workspace → Workspace · Members & permissions

On this page