Permissions and module visibility
What you can do in Elie comes from two things: the modules your organisation is entitled to, and what your role grants inside them. This page is the reference for both.
How visibility works
Two checks decide every module, in this order:
- Your organisation must be entitled to the module. Platform staff set entitlements, and no role reaches past them.
- Inside an entitled module, your role must grant that module's View permission, the one named against each module below.
The top bar and All apps show only the modules that pass both checks. If you open a module's address anyway, Elie doesn't redirect you: a dialog says which check failed. Voice IntELIEgence is not part of your plan means your organisation isn't entitled to it; You do not have access to Voice IntELIEgence means your role is the reason. Closing the dialog takes you to your dashboard. Administrators also see the modules your plan lacks in All apps, greyed out with a padlock and Not in your plan.
Inside a module the server still checks each request as it is made. Many buttons hide or grey out when your role can't use them, but some screens only find out when they ask, and then show 403 and Access Forbidden, or come back empty. For the full set of symptoms, see What your role can see.
Where permissions are granted
Roles carry permissions; departments and groups carry none. Open Access Control, then
Roles, then the role. Its Permissions section lists every permission your
organisation can grant, grouped by module and feature. The default Split view shows each
feature as Module · Feature on the left and its verbs as switches on the right, and three
more layouts sit beside it: Table view, Grouped view and Module view.
Use Search permissions to find a module, feature or permission by name, Access level to narrow the list to Read, Write or Manage verbs, and Granted only to see what the role holds. Nothing is saved until you select Save Permissions.
Some permissions need others to be useful. Granting one also grants what it needs, and the screen tells you how many it added. You can't switch off a permission that another granted one depends on until you switch that one off first. A locked SYSTEM role reads This is a locked system role and cannot be modified.
This manual names a permission as Module · Feature - Verb, for example
IntELIEKonnect · Import - Update.
The verbs
| Verb | Granting it lets someone |
|---|---|
| View | See that an item exists, and read its metadata or summary. A module's View is what puts it in the top bar. |
| List | Enumerate every item of that kind. |
| Read | Open the item itself: its content, configuration or details. |
| Create | Add a new one. |
| Update | Change it, including who belongs to it. |
| Delete | Delete or remove one. |
| Execute | Privileged actions: triggering a run, assigning roles, resetting a password, verifying integrity. |
A feature offers only the verbs that mean something for it, so most have fewer than seven. A few use a single Manage verb in place of Create, Update and Delete. Access level groups the verbs: Read covers View, List and Read; Write covers Create, Update and Delete; Manage covers Execute.
Knowledge Base
The module opens with Knowledge Base · Component - View.
| Feature | What it covers | Verbs |
|---|---|---|
| Knowledge Base · Component | Knowledge bases themselves: finding and opening one, creating, configuring, retiring and deleting them. | All seven |
| Knowledge Base · Document | The documents and Q&A pairs inside one: adding, reading, re-versioning, changing access and deleting them. | All seven |
| Knowledge Base · Chat | Asking questions, reading past chats and deleting them. Execute is what lets someone ask. | View, List, Read, Delete, Execute |
| Knowledge Base · Analytics | Query analytics, retrieval traces, feedback and evaluations. Create and Update edit the golden set; Execute starts an evaluation run. | View, List, Read, Create, Update, Execute |
| Knowledge Base · Setup | Sources, settings, access grants and widget tokens. | View, List, Read, Create, Update, Delete |
An evaluation searches the whole knowledge base whatever the runner's own access, so grant Analytics Create and Execute only to people you trust with that.
IntELIEDocs
The module opens with IntELIEDocs · Document - View.
| Feature | What it covers | Verbs |
|---|---|---|
| IntELIEDocs · Document | Documents: their metadata and content, uploading, saving corrections and removing them. Execute covers Re-run, Mark as Reviewed and downloading the extracted data. | All seven |
| IntELIEDocs · SmartExtract | A Smart Extract orchestrator's configuration. | All seven |
| IntELIEDocs · SmartClass | A Smart Classes orchestrator's configuration. | All seven |
| IntELIEDocs · SmartQueue | A Smart Queue orchestrator's configuration. | All seven |
| IntELIEDocs · SmartRedact | A Smart Redact orchestrator's configuration. Execute runs a redaction. | All seven |
| IntELIEDocs · Original document | Seeing and downloading the unredacted original of a redacted document, on every Smart Redact the person can open. | View only |
| IntELIEDocs · Group | Document groups and their members. | All but View |
| IntELIEDocs · Workbench | Viewing documents and tasks in the workbench, and actioning them. | Read, Execute |
| IntELIEDocs · Intake | Triggering document intake processing. | Execute only |
| IntELIEDocs · Document events | Triggering document lifecycle events. | Execute only |
| IntELIEDocs · Audit events | Reading audit events recorded inside IntELIEDocs. | Read only |
| IntELIEDocs · Audit integrity | Triggering an integrity check over those events. | Execute only |
Inside IntELIEDocs, many controls follow your role instead of failing when you use them. The orchestrator rail and the header's Create menu leave out the kinds your role cannot open or create. On a document, Re-run and Mark as Reviewed are absent without Execute on IntELIEDocs · Document, and Remove without Delete; Save stays visible but disabled without Update, and Upload Document is disabled without Create.
IntELIEKonnect
The module opens with View on either feature.
| Feature | What it covers | Verbs |
|---|---|---|
| IntELIEKonnect · Import | Import connectors and their bindings. Execute starts a run with Fetch now. | All seven |
| IntELIEKonnect · Export | Export connectors and their bindings. Execute starts a delivery with Deliver now. | All seven |
Voice IntELIEgence
The role editor calls this module Voice, and shows one feature for it. The module opens with Voice · Application - View.
| Feature | What it covers | Verbs |
|---|---|---|
| Voice · Application | Voice applications across your organisation: seeing and listing them, creating one, and retiring one from its settings. | View, List, Create, Delete |
Everything inside an application (conversations, transcripts, outputs, the dashboard, analytics, grading, topics and sentiment, chat, personas, import, export and settings) is granted per application, from that application's Access page rather than from a role. Tenant administrators and the application's owner can open that page. See Who can see a voice application.
Identity and users
| Feature | What it covers | Verbs |
|---|---|---|
| Identity & Users · User | People: their profiles, their account status, and admin actions such as forcing a password reset or revoking a session. | All but Create (people arrive by invitation) |
| Identity & Users · Invitation | Invitations. Create sends one; Delete revokes a pending one. | All but Update |
| Identity & Users · Department | Departments and their members. | All seven |
| Identity & Users · Group | Groups and their members. | All seven |
| Identity & Users · Api Integration | Partner API integrations. List opens Developers; Create adds an integration. | List, Create |
| Identity & Users · Api Key | API keys. Create issues one, Update regenerates one and Delete revokes one. List shows them, never their secrets. | List, Create, Update, Delete |
| Identity & Users · Api Settings | Partner API rate-limit settings. No screen in the workspace uses it yet. | Read, Manage |
Access Control opens with View on any of User, Department, Group or Invitation, or on Roles & Permissions · Role. See Managing API keys for the Developers area.
Roles and permissions
| Feature | What it covers | Verbs |
|---|---|---|
| Roles & Permissions · Role | Roles and their permission sets. Update edits a role's permissions; Execute assigns or revokes a role on a person. | All seven |
Audit logs
The module opens with Audit Log · Events - View.
| Feature | What it covers | Verbs |
|---|---|---|
| Audit Log · Events | Tenant audit events. | View, List, Read, Execute |
| Audit Log · Integrity | Integrity checks over those events. Execute starts a verification run. | View, List, Read, Execute |
What the role editor leaves out
- Billing. Only the tenant administrator role holds billing permissions, and they can't be granted to any other role, so the editor shows none.
- Modules your organisation isn't entitled to. Their rows appear once the entitlement does.
- Read across every visibility scope (
intelie_docs.visibility.read). It belongs to automated indexing, and no person's role may hold it.
Next
- Managing roles - where these are granted, and why a SYSTEM role resists editing.
- What your role can see - telling a refused page from an empty one.
- How access control works - roles, departments and groups.