Policy Resolution
Assistant actions are evaluated from workspace role capability, assistant capability, and plan/feature gates.
Effective Permission = Workspace Role Capability AND Entity Capability AND Plan/Feature GateOperation To Gate Mapping
| Operation | Gate |
|---|---|
| Open assistant editor | canRead |
| Run assistant chat | canRun |
| Edit behavior and prompt | canUpdate |
| Publish or revert | canUpdate |
| Delete assistant | canDelete |
| Move across workspace or org | canTransfer |
Role Availability Matrix
| Role | View | Run | Edit/Publish | Delete | Transfer |
|---|---|---|---|---|---|
| Owner | Yes | Yes | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes | Yes | No |
| Contributor | Yes | Yes | Yes | No | No |
| Reader | Yes | Yes | No | No | No |
| Guest | No | Limited | No | No | No |
Note:
Backend authorization is final for update, delete, transfer, and publish actions.
FAQ
How are assistant permissions calculated?+
Effective permission is computed from workspace role capability, assistant entity capability, and plan or feature gates.
Q1
Can Reader use assistants?+
Yes. Reader can view and run assistants where supported, but cannot edit, publish, delete, or transfer.
Q2
Can Contributor delete assistants?+
No. Contributor can create and update assistants but cannot delete or transfer them by default.
Q3
Can Admin transfer assistants by default?+
No. Transfer remains role-capped unless explicit transfer capability is granted.
Q4
Are backend checks still applied when buttons are visible?+
Yes. Backend authorization remains authoritative for every protected action.
Q5
Tip:
For cross-entity policy details, see Workspace Permissions Matrix.