How to Set Up Role-Based Permissions for AI Agents

Giving an AI agent access to company data works best when you decide the limits first. This guide walks through a practical setup for AI agents that keeps people in control.

Before you start

You will need:

• A list of the teams and projects whose knowledge agents will use
• An owner or admin who can approve rules
• One narrow task to start with

Step 1: Define the agent's job

Write the task in one or two plain sentences. A renewal-drafting agent, for example, should not also answer HR questions. A narrow job makes the boundaries easy to set and easy to check.

Step 2: Scope the company memory

Decide which teams, projects, and roles the agent can draw from. Start small and widen access later. Your knowledge graph connects company memory, so scoping keeps the agent to the parts that matter for its task.

Step 3: Set access by role

Tie the agent's permissions to the roles of the people it works for. If a member is revoked, their access ends immediately.

Step 4: Choose a model policy

Pick which models the agent may use. If data must stay inside your walls, choose the self-hosted option.

Step 5: Decide what needs approval

Anything that leaves the company, such as sending a draft to a vendor, should wait for a person to approve. Approval rules are coming soon, so plan for them now.

Step 6: Review what it learns

When someone corrects an answer, the correction is saved with who made it and why. An owner or admin reviews it before it changes agent behavior, and you can roll it back.

See trust and controls for more on how permissions work.