Roles

Roles define permissions to view Console features, view data, and edit configurations.

Roles can be assigned to Users and Groups.

When a User inherits Roles from multiple Groups, their set of permissions is called their Effective Role.

A User’s Effective Role is the highest role inherited, i.e. the Role with the most permissions.

Open the Roles page from Administration > Access Control > Roles.

The page shows one row per role. Each column after Role Name shows that role's access to one area of the product: Secure AI Portal, Analytics, Discovery, Conversations, Alerts, Policy, Lists, Settings, RBAC and See VIPs.

An eye icon means view-only access, and a pencil means the role can add, edit and delete. In the RBAC column, the pencil stands for Edit Users, Groups, & Roles. Only the Super Admin row has a pencil-plus icon there, for Edit Users, Groups, & Roles + assign Super Admins. A crown under See VIPs marks the roles that can see VIP data: User Admin and Super Admin.

The Chat User role only provides access to the Secure AI Portal (the “Portal”), which is our chat-style interface. The Portal can connect to almost any Public or Private LLM Model that support a chat-style interface. Most current Models can be used from within the Portal, although some will require configuration from WitnessAI.

If your highest effective Role is the Chat User, when you login to the WitnessAI Application you will only access the Portal.

The Console User role can access the Portal, and they can also access the following Console pages and components in view-only mode:

The Policy Viewer role permits all the access above, plus view-only permission on:

The Policy Manager role permits all the access above, plus add, edit, and delete permissions on:

The Admin role grants all the access above, plus edit permissions on:

The User Admin role grants all the access above, the ability to view VIP data, plus edit permissions on:

The Super Admin role grants all the access above, plus permissions to grant and revoke the permission to view VIP data to Groups.

Users with Super Admin role can access and copy API Keys, even after a user exits the API Keys page.

Only a Super Admin can assign the Super Admin role.