Governance, Access & Permissions
Access control in Ema uses predefined roles (bundles of permissions) and permission bits (atomic actions) across three object levels: Workspace, AI Employee, and Project. You can assign preset roles but cannot create, edit, or delete roles or permission bits.
Key Concepts
| Term | Definition |
|---|
| Workspace | Your organization's container in Ema. Workspace roles can cascade down to all AI Employees and Projects inside it. |
| AI Employee | An AI worker configured for a specific purpose. AI Employee roles control who can view, build, manage users, and create Projects. |
| Project | Work artifacts under an AI Employee. Project roles control who can view, edit, and share a single project. Not all AI Employees have Projects -- today their usage is restricted to Document Generation and Recruiter type AI Employees. |
| Role | A tier that a user holds for a Workspace, AI Employee, or Project. |
| Permission bit | A single capability (e.g., invite users, edit workflow canvas). Roles are collections of these bits. |
| Preset roles only | Roles and permission bits are centrally defined. Builders use them; builders do not customize them. |
| Inheritance | A higher-level role can implicitly grant appropriate access at lower levels. For example, a qualifying Workspace role implies AI Employee access; some Project roles imply minimal AI Employee access so users can operate the project. |
Object Levels
- Workspace -- Use for organization-wide responsibilities (invite users, create AI Employees, see settings and metrics). When a Workspace role implies AI Employee access, it applies to all AI Employees in that Workspace.
- AI Employee -- Use when a person needs to build or manage one AI Employee (including its users, canvas, and evaluations) and create Projects beneath it.
- Project -- Use when a person only needs access to one Project. There is a single role at this level (Project User) which has all necessary permissions and is automatically assigned. Project roles automatically grant minimal AI Employee access.
Role Catalog
Ema provides eight preset roles across the three levels:
| Level | Role | Primary Intent |
|---|
| Workspace | Workspace Admin | Full workspace administration |
| Workspace | Workspace Manager | Manage people and settings without full admin |
| Workspace | Workspace Builder | Create and organize AI Employees |
| Workspace | Workspace Guest | Minimal workspace access |
| AI Employee | AI Employee Admin (PERSONA_ADMIN) | Full control of one AI Employee |
| AI Employee | AI Employee Manager (PERSONA_WRITE) | Manage AI Employee users and settings |
| AI Employee | AI Employee Project User (PROJECT_WRITE) | Access to work within projects under an AI Employee |
| Project | Project User | Full access to work within a single project |
Permission Matrices
Workspace Permissions
| Permission Bit | Description | Admin | Manager | Builder | Guest |
|---|
| Create AI Employees | Create new AI Employees in the workspace | Y | -- | Y | -- |
| Invite Users | Send invitations to add users | Y | Y | -- | -- |
| Change User Permissions | Modify other users' role assignments | Y | Y | -- | -- |
| Remove Users | Remove users from the workspace | Y | Y | -- | -- |
| View Tenant Metrics | View workspace-level analytics | Y | Y | -- | -- |
| View Workspace Settings | View workspace configuration pages | Y | Y | -- | -- |
| View Audit Logs | View audit and activity logs | Y | -- | -- | -- |
| Create Template from AI Employee | Convert an AI Employee into a reusable template | Y | -- | -- | -- |
| Create Child Tenant | Create a child workspace | Y | -- | Y | -- |
| Manage Flags | Manage feature/configuration flags | Y | -- | -- | -- |
| Manage Template List | Manage available templates | Y | -- | -- | -- |
| Manage Persona Groups | Organize AI Employees into groups | Y | Y | Y | -- |
| Default AI Employee role | Auto-granted for all AI Employees | AI Employee Admin | AI Employee Manager | No default | No default |
AI Employee Permissions
Certain Workspace roles automatically grant AI Employee roles. Workspace Admin implies AI Employee Admin; Workspace Manager implies AI Employee Manager. These inherited permissions apply across all AI Employees in the workspace.
| Permission Bit | Description | Admin | Manager | Project User |
|---|
| View AI Employee | View configuration | Y | Y | Y |
| Edit AI Employee | Edit configuration and settings | Y | N | -- |
| Use AI Employee | Run the AI Employee | Y | Y | Y |
| Share AI Employee | Share with others | Y | Y | -- |
| Delete AI Employee | Delete the AI Employee | Y | -- | -- |
| Rename AI Employee | Rename the AI Employee | Y | Y | -- |
| Change Status | Enable/disable the AI Employee | Y | Y | -- |
| View Users | View all users with access | Y | Y | -- |
| Add Users | Grant users access | Y | Y | -- |
| Remove Users | Revoke users' access | Y | Y | -- |
| Edit User Permission | Change another user's role | Y | Y | -- |
| View Workflow Canvas | View the workflow canvas | Y | Y | Y |
| Edit Workflow Canvas | Edit the workflow canvas | Y | -- | -- |
| Run Evaluations | Run evaluations on the AI Employee | Y | -- | -- |
| View Metrics | View AI Employee-level analytics | Y | Y | -- |
| View Training & Logs | View training artifacts and logs | Y | Y | -- |
| Create Project | Create a new Project under this AI Employee | Y | Y | Y |
| Doc Writer - Restore Section | Restore a previous Doc Writer section version | Y | Y | -- |
| Doc Writer - Approve Section | Approve a Doc Writer section | Y | Y | -- |
Project Permissions
Some AI Employee roles automatically grant Project access. AI Employee Admin and AI Employee Manager imply appropriate Project-level access where needed; Project roles may also come with minimal AI Employee access so users can operate the project.
| Permission Bit | Description | Project User |
|---|
| View Project | View project artifacts and configuration | Y |
| Edit Project | Edit project artifacts and configuration | Y |
| View Users in Project | View who has access | Y |
| Share Project | Share with others | Y |
| Remove User from Project | Remove a user from the project | Y |
| View Parent AI Employee | View the parent AI Employee's configuration | Y |
How to Use
- Choose the level. Decide whether access belongs at the Workspace, AI Employee, or Project level. Default to the lowest level that satisfies the need.
- Pick the preset role. Match responsibilities to a role using the catalog above.
- Use a Project role for single-project contributors.
- Use AI Employee Manager for workflow managers or AI Employee Project User for project contributors.
- Use Workspace Admin or Workspace Manager for workspace-wide operations.
Related Pages