# Understand Roles and Permissions

Explains the different roles a user can be assigned to and their permissions on the platform

## Platform Features

The following roles are managed on Unique’s IDP and include access and permissions for platform features. However, permissions and access to content/spaces are not part of this overview but specified in the Spaces concept (Spaces documentation will follow soon).

| **Zitadel Key** | **Zitadel Display name** | **Zitadel Group** | **Unique Capabilities** | **Capabilities and functionalities** |
|-----------------|--------------------------|------------------|-------------------------|-------------------------------------|
| chat.chat.basic<br>Live | chat with limit to input | chat | Chatting interface w/ potential limit to the chat input | - Access to chatting interface<br>  <br>Default settings for end user to chat with the application |
| chat.knowledge.read<br>Live | view knowledge base | knowledge-base | View central knowledge base | - View (incl. download) central knowledge base |
| chat.knowledge.write<br>Live | upload knowledge base | knowledge-base | Upload central knowledge centre | - Allowed to upload files into knowledge centre |
| chat.data.admin<br>live | chat.data.admin | admin | Can see all user feedback and and user prompts analytics | - Read and export [user feedback (i.e. export CSV)](https://unique-ch.atlassian.net/wiki/x/TwKRUg) incl. user prompt<br>  <br>- Read and export [detailed interaction interaction](https://docs.unique.ai/administrators/insights-measurement/analytics-interface/analytics) analytics with user prompts <br>  <br>- Read and export [DLP analytics](https://docs.unique.ai/it-operators/operations/security-and-data-privacy/data-leakage-prevention-dlp) |
| chat.feedback.read<br>Live | read chat-feedback | admin | Can see aggregated analytics (e.g. monthly active users, prompts per space) and upload and download benchmarking | - Read and export aggregated user analytics ( [Chat Interactions](https://docs.unique.ai/administrators/insights-measurement/analytics-interface/analytics), [Active Users](https://docs.unique.ai/administrators/insights-measurement/analytics-interface/analytics), [Reference Statistics](https://docs.unique.ai/administrators/insights-measurement/analytics-interface/analytics), NPS)<br>  <br>- Upload and download benchmarking (see [Benchmarking](https://docs.unique.ai/administrators/models-llm-management/benchmarking)) |
| chat.admin.all<br>Live | configure assistant | admin | Has access to many APIs for performing configurations. But has **no access** to APIs getting actual data like messages or documents. | - Allows configuration and access via API<br>  <br>This is an admin role that should only be granted to a few selected users. |
| chat.debug.read<br>Live | debugging | admin | Can see debugging infos | - Debugging (view jsons and chunks with access to knowledge) |
| admin.user-management.write<br>Live | Manage groups for users | admin | Can see user management section | - Add and remove users to groups |
| admin.space.write<br>Live | Configure spaces | admin | Can see space management section and the AI module templates section | - Configure spaces (e.g. add, update, remove space) |
| admin.app-repository.write<br>Live | Manage app repository | admin | Can see apps management section | - Create apps for SDK and integrations<br>  <br>- Create endpoints where Webhook events are being sent to<br>  <br>- Create API Keys that allow full system access via APIs<br>  <br>- Review RequestLogs of Webhooks sent by our system |
| connector.admin.read<br>BETA | View MCP configs | admin | View MCP connector configurations | - View MCP connectors<br>  <br>- Check configurations of existing MCP connectors |
| connector.admin.write<br>BETA | Manage MCP configs | admin | Create and modify MCP connector configurations | - Add new MCP connectors<br>  <br>- Manage existing MCP connector configurations |

## Content and Spaces

Access to content and spaces is fully managed on the Unique platform and outside of the IDP. As a Space Manger with the role admin.space.write you can decide which user groups have access to which space. Only the user groups assigned to a space can view the space (Spaces documentation will follow soon).

## Add new roles to existing tenants

When a new chat role is created they are not automatically distributed to existing tenants. Therefore an IDP owner of this existing tenant has to add the new role to the existing tenant. This is done by following these steps:

1. On Cluster IAM level go to projects / owned projects / Unique Apps

2. Navigate to “Roles”, there you see an overview of all the roles that are possible to distribute on that tenant in the moment. Compare this list to the one above in the Platform Features section.

3. If a role is missing navigate to “+New”

5. Add the new role. The needed information is displayed in the list above

6. The new role will appear in the Project Roles

7. The new role then needs to be granted to the organizations that require it. Navigate to the Project Grants section, select a grant (by clicking on it) and adjust the grant to include the newly created role.