Permissions & access groups
Control what people and agents can use without giving everyone administrator access.
access permissions roles admin RBAC groups security memberOn this page
How an agent's access worksReview a person or agentUse access groupsAdministrator accessPermissions are not approvalsDiagnose missing accessHow an agent's access works
Every agent has an owner. An agent never does more than its owner could, and never more than the person talking to it may do in Opser. Changing a person's grants therefore changes what the agents they own can do, and what any agent can do for them.
Giving someone access to an agent lets them use it; it does not let them do through the agent what they could not do themselves. Who may use an agent and what it may do are separate decisions. See Give people access.
An action can check the agent, its owner, and the person making the request, as well as the target record's rules. Access to an agent does not automatically authorize every action the agent could perform.
Review a person or agent
Open Settings → Access if you have permission to manage access. Select the relevant person or agent and inspect their effective access. Grants can come from individual permissions and assigned access groups.
Maya is not an administrator. Her Customer success group grants portal access; billing management is not granted.
Use the permission groups to find the relevant platform area or app. Some apps separate reading, collaboration, and management. Giving someone permission to read records does not necessarily let them configure the app.
Use access groups
Access groups collect permissions for a common responsibility. Create a group with a clear name and purpose, add the intended permissions, and assign the appropriate people or agents.
For example, an operations group might grant access to specific task and purchasing workflows while leaving billing administration to administrators. Review membership whenever a person’s responsibility changes.
Group changes affect the principals assigned to the group. Check effective access after removing a grant: another group or direct permission may still provide it.
Administrator access
Administrator status provides broad workspace authority, including settings such as organization management and billing. Use it for people who need to administer the workspace. Prefer focused permissions and groups for ordinary app work.
Permissions are not approvals
Permissions define available authority. Approvals decide whether an authorized agent action should wait for a person to review it. Approving an action cannot bypass a missing permission.
App-level sharing and membership also matter. A mailbox, private chat channel, or shared document can have its own access rules in addition to platform permissions.
Diagnose missing access
Check the selected user or agent, direct grants, group membership, app installation, and any record-specific sharing. Refresh after a change and try a small read operation before repeating the original task.