RBAC permission reference

This reference enumerates every field of the Add / Edit Role dialog — the RBAC grant that decides what a user can see, what they can do, and which lifecycle stages they may act on. The model itself is taught in Access & roles; open this page when you need to build a role precisely.

The mental model: a role is a bundle of grants

When you open + Role, you are filling in one object made of two layers of security:

• Feature-level security — which Studio pages and capability actions the role can use. These drive the permission gates that hide buttons and fields all over Studio and the runtime. (Stored as AllowedStudioPages + AllowedActionIds.)
• Row / label-level security — which documents and labels the role can even see or train on. (Stored via the Label Content Filter and Label selection / LearnerMeta.)

A role also carries scope: the Entity (collection) it applies to and the Stages it works in. Stage scope is the bridge to the lifecycle — see “How roles gate lifecycle stages” below.

Tip. Every individual action in the dialog has its own inline help “i” bubble keyed RAR<ActionName> (for the action list) or an SR0xx code (for the field). Hover them in the product for the canonical one-liner.

Basic fields (always visible)

Field	Control	Required	What it does	Help
Role Name	text	yes	The role’s display name (e.g. L1-Reviewer). Appears on stage gates, user assignments, and View “Allowed roles” chips.	SR001
Entity	multi-select of the project’s collections	yes	Scopes the role to one or more collections. Changing it re-filters the Stage list — you can only pick stages that belong to the chosen entities.	SR0015
Stage	searchable multi-select	—	The lifecycle stages this role may work in. Options are grouped and labelled <workflowName> > <stageName>; there is an in-dropdown search box. Gated by ['security','Stage','Add Role'].	—
Users in Access Roles	user multi-select	—	Assigns project users to this role (you can also assign users from the Users surface). Gated by ['security','Users in Access Roles','Access Roles'].	SR002

Advanced fields (behind “Show Advanced Settings”)

Click Show Advanced Settings to reveal the capability and filter grants. This is where most of the RBAC power lives.

Field	Control	What it does	Stored as	Help
Select action(s) for this role	multi-select of the platform’s capability actions	The core capability grant. Each entry is one thing the role may do (the per-item bubble is RAR<ActionName>). This is what most permission checks resolve against.	AllowedActionIds	SR003
Label selection	learner → label picker	Restricts which labels (fields) the role may train on. Edit/delete chips once set. Gated ['security','Label Content Filter','Add Role'].	LearnerMeta	—
Label Content Filter	label picker with a required value	Row-level data filtering. Restricts the documents the role can see to those whose label equals a value (e.g. only documents where region = EMEA). Requires a value to take effect. Same gate as Label selection.	(label filter)	—
Training Icons	multi-select	Which annotation / training tools the role sees in the document viewer. When the full set is selected it is stored as [] meaning “all”.	(training actions)	SR005
Allowed Document Actions	multi-select	Per-document operations the role may perform (the document-level action buttons).	(document actions)	SR006
Allowed Studio Pages	multi-select	Which Studio sections the role may open. The choices are: Project, Data Model, Connector, Automation, Search, Chat, Intelligence, AI Builder, Agent Builder, Asset Builder, Data Lake, Security. This is page-level gating — a role with no Studio pages is a runtime-only (consumer) role.	AllowedStudioPages	SR007
Allowed Summary Pane Actions	multi-select	Summary-pane operations: Lookup Update, Re-Group Summary.	(summary actions)	SR008

Footer: Create / Update button (gated ['security','Create','Add Role']), disabled while the form is invalid; shows a spinner while saving. View mode (opening a role read-only) shows a flat table of Role Name, Actions, and Users — no editing.

Under the hood. Saving a role writes back into the shared role signal, so Studio re-gates immediately — buttons appear and disappear without a reload. Two quirks worth remembering: Training Icons equal to the full set are stored as [] (“all”), and the Entity choice is what filters the Stage options.

How roles gate lifecycle stages

This is the link to the review flows described in Human-in-the-loop. A lifecycle stage has a Can be viewed by setting (ViewedByRoleIds). Whatever roles you list there are the only roles that can see and act on documents sitting in that stage (empty = every role). The connection runs both ways:

• On the stage (Data Model ▸ Lifecycle ▸ edit a stage): you pick roles in Can be viewed by — this writes ViewedByRoleIds.
• On the role (here): the Stage field records which stages the role is meant to work in.

So to make a stage L1-only:

1. Create an L1-Reviewer role here (Entity = your collection; give it the review actions and document actions L1 needs).
2. Go to the stage’s Can be viewed by and add L1-Reviewer.

The seeded Four-Eyes flow already ships this pattern: L1 Review is gated to L1-Reviewer (+ L2-Approver + Admin), and L2 Approval — the final human gate — is gated to L2-Approver (+ Admin). That is the L1-Reviewer / L2-Approver pattern: two distinct roles, two distinct gated stages, “four eyes” before a document is approved.

Watch out. Deleting a role warns “Users and workflow stages mapped to this role (if any), will no longer exist…” — removing a role also breaks any stage gate that referenced it, which can silently make a stage visible to everyone (empty ViewedByRoleIds = all). Re-check your stage gates after deleting a role.

Quick recipes

You want…	Set this
A consumer-only reviewer (no Studio access)	Leave Allowed Studio Pages empty; grant the review actions + Allowed Document Actions; assign the Stage.
A builder who can edit the data model but not security	Allowed Studio Pages = Data Model, Project (omit Security).
Restrict a team to one region’s documents	Label Content Filter = region with value EMEA.
Let a role train only certain fields	Label selection = just those labels.
The final approver gate	A role gated onto the L2 Approval stage’s Can be viewed by.