Roles and Permissions Reference

Sol Helps evaluates access in two layers:

1. The role template must contain the requested permission key.
2. When an assistant ID is involved, the user's assistant scope must include it.

An empty assistant scope means all assistants allowed by the role. It does not mean no access.

Role templates and permission keys

This matrix is generated from the application's canonical role and permission definitions:

Role template	Permission keys
Owner OWNER	assistants.read assistants.create assistants.update assistants.delete knowledge.read knowledge.upload knowledge.delete conversations.read conversations.review conversations.export insights.read insights.export team.read team.invite team.remove_member team.update_role billing.read billing.manage_plan billing.manage_payment_method company.delete security.read_audit security.manage_retention security.manage_sso api_keys.create api_keys.rotate api_keys.revoke
Admin ADMIN	assistants.read assistants.create assistants.update assistants.delete knowledge.read knowledge.upload knowledge.delete conversations.read conversations.review conversations.export insights.read insights.export team.read team.invite team.remove_member team.update_role billing.read billing.manage_plan billing.manage_payment_method security.read_audit security.manage_retention security.manage_sso api_keys.create api_keys.rotate api_keys.revoke
Member MEMBER	assistants.read knowledge.read conversations.read insights.read team.read billing.read
Viewer VIEWER	assistants.read knowledge.read conversations.read insights.read team.read billing.read
Support Analyst SUPPORT_ANALYST	conversations.read conversations.review conversations.export insights.read
Content Manager CONTENT_MANAGER	assistants.read assistants.update knowledge.read knowledge.upload knowledge.delete insights.read
Billing Admin BILLING_ADMIN	billing.read billing.manage_plan billing.manage_payment_method
Security Admin SECURITY_ADMIN	security.read_audit security.manage_retention security.manage_sso

Owner has every permission. Admin has every permission except company.delete. Member and Viewer currently resolve to the same read-only template; keep the distinct product labels because future policy may differ.

Effective-access examples

• A Support Analyst scoped to one assistant can read, review, and export that assistant's Captured Questions and read its Insights.
• A Member can read Insights but cannot send a webhook because that requires insights.export.
• A Content Manager can update an assistant and manage its knowledge, but does not receive conversation access from that role.
• Removing an assistant from a non-empty scope immediately makes assistant-specific permission checks fail for that assistant.
• Selecting “all assistants” can be rejected for a scoped user even when their role contains the underlying permission.

Company-level actions without an assistant ID are controlled by the role permission alone. API routes also validate workspace ownership and can return 403 even when a UI control was previously visible.

For the administrative workflow, see Invite People and Manage Access. For access failures, see Troubleshooting.