Permissions

Role-based access control and temporary, time-limited permission grants for Classic API users and organizations.

Manage access control and permissions for your Amigo implementation.

Classic API. These role-based permissions apply to Classic API users and organizations. The Platform API uses workspace-scoped API keys for authentication. See Platform API Authentication.

Permission System

Role-Based Access Control

Role-Based Permissions

Temporary Access

Temporary Permission Grants

Key Concepts

Roles

Predefined sets of permissions. Each new organization is seeded with four default roles: DefaultUserRole, DefaultAdministratorRole, DefaultAmigoAdministratorRole, and DefaultSuperAdministratorRole. You can also define fully custom roles with arbitrary names.

Permissions

Granular access controls for specific operations, expressed as Category:Action grants (for example, Conversation:CreateConversation) with optional conditions that limit when they apply. See Role-Based Permissions for the grant format.

Security Best Practices

• Apply least privilege. Design roles with the narrowest allow grants that still cover the job, and scope almost every grant to the user's own organization. See Role-Based Permissions best practices.
• Prefer temporary grants for debugging. Request time-limited, per-conversation access instead of holding a broad role. See Temporary Permission Grants.
• Audit permissions regularly. Review custom roles and active temporary grants (for example, with forge conversation list-access) so stale access does not accumulate.
• Rotate API keys. API keys inherit their creator's permissions, so set expiration dates and rotate before expiry. See Authentication.

Related Topics

• Authentication
• User Management