Permissions and module visibility

What you can do in Elie comes from two things: the modules your organisation is entitled to, and what your role grants inside them. This page is the reference for both.

How visibility works

Two layers decide every action, in this order:

1. Your organisation must be entitled to the module. Platform staff set entitlements, and no role reaches past them.
2. Inside an entitled module, your role must grant the permission.

Neither layer hides much. Your menu lists the modules whatever your role holds, because the server authorises each request as it is made rather than each page as it opens. A permission you lack therefore surfaces late: the module is replaced by the 403 / Access Forbidden screen, or a list simply comes back empty with no message. Voice IntELIEgence is the one exception — it is absent from the menu until it is enabled for you, and its address redirects to Access denied. For the full set of symptoms, see What your role can see.

Where permissions are granted

Roles carry permissions; departments and groups carry none. A role's grid is at Access Control → Roles → the role, under Permissions. Each row is one feature, each column one verb, and a - in a cell means that feature has nothing for that verb, so nobody can be granted it. Search by feature name matches the row labels below, spelled exactly as they appear here.

The seven columns

Column	Ticking it lets someone
VIEW	See that an item exists, and read its metadata or summary.
LIST	Enumerate every item of that kind.
CREATE	Add a new one.
DELETE	Delete one.
READ	Open the item itself — its content, configuration or details.
UPDATE	Change it, including who belongs to it.
EXECUTE	Privileged actions: triggering a run, assigning roles, resetting a password, verifying integrity.

Knowledge Base

Feature row	What it covers	Columns offered
Knowledge Base · Kb	A knowledge base itself — that it exists, its configuration, its members.	All seven
Knowledge Base · Document	The documents inside one: adding, reading, re-versioning and deleting them.	All seven

IntelieDocs

Feature row	What it covers	Columns offered
IntELIEdocs · Document	Documents: their metadata, their content, uploading and deleting them.	All seven
IntELIEdocs · Smartextract	A Smart Extract orchestrator's configuration.	All seven
IntELIEdocs · Smartclass	A Smart Classes orchestrator's configuration.	All seven
IntELIEdocs · Smartqueue	A Smart Queue orchestrator's configuration.	All seven
IntELIEdocs · Smartredact	A Smart Redact orchestrator's configuration.	All but EXECUTE
IntELIEdocs · Redact Original	Viewing the unredacted original of a redacted document.	VIEW only
IntELIEdocs · Group	Document groups and their members.	READ, CREATE, UPDATE, DELETE, EXECUTE
IntELIEdocs · Workbench	Viewing documents and tasks in the workbench, and actioning them.	READ, EXECUTE
IntELIEdocs · Intake	Triggering document intake processing.	EXECUTE only
IntELIEdocs · Docevent	Triggering document lifecycle events.	EXECUTE only
IntELIEdocs · Audit Events	Reading audit events recorded inside IntelieDocs.	READ only
IntELIEdocs · Audit Integrity	Triggering an integrity check over those events.	EXECUTE only

IntelieKonnect

Feature row	What it covers	Columns offered
IntELIEKonnect · Import	Import connectors, and starting a run with Fetch now.	All seven
IntELIEKonnect · Export	Export connectors, and starting a delivery by hand.	All seven

Voice IntELIEgence

Voice rows are prefixed Voice, not the module's full name.

Feature row	What it covers	Columns offered
Voice · App	A voice application — that it exists, and its configuration.	VIEW, CREATE, UPDATE
Voice · Conversation	Conversations inside an application.	VIEW, DELETE
Voice · Audit	Voice audit records.	VIEW only
Voice · Export	Voice export records.	VIEW only

Identity and users

Feature row	What it covers	Columns offered
Identity & Users · User	People: their profiles, their account status, and admin actions such as forcing a password reset or revoking a session.	All but CREATE — people arrive by invitation
Identity & Users · Invitation	Invitations. CREATE sends one; DELETE revokes a pending one.	All but UPDATE
Identity & Users · Department	Departments and their members.	All seven
Identity & Users · Group	Groups and their members.	All seven

Roles and permissions

Feature row	What it covers	Columns offered
Roles & Permissions · Role	Roles and their permission sets. UPDATE edits a role's permissions; it is EXECUTE that assigns or revokes a role on a person.	All seven

Audit logs

Feature row	What it covers	Columns offered
Audit Log · Events	Tenant audit events.	VIEW, LIST, READ, EXECUTE
Audit Log · Integrity	Integrity checks over those events; EXECUTE starts a verification run.	VIEW, LIST, READ, EXECUTE

Next

• Managing roles — where these are ticked, and why a SYSTEM role resists editing.
• What your role can see — telling a refused page from an empty one.
• How access control works — roles, departments and groups.