Onboarding seeds a minimal, normal Role catalog for enterprises — enough to run the platform and start business work. You extend that catalog for how your organization actually works. Prefer quality over quantity: add a role when the business needs a distinct way of working, not because a system or API needs another technical label.
Roles are business roles, not technical permission dumps. They describe how people and Role Assistants perform work (Sales Manager, Finance Approver, Platform Admin). Role Assistants are built around those roles — the active role bounds what work may be requested; dimensions and protection bound which records are in scope.
There is one Role catalog in the Controller. AI Fabrix platform roles and your enterprise business roles live together. Groups bind to roles; roles carry permissions and packaging for assistants.
Why it matters
Operators need a clear answer to what does this role mean for people and assistants? without reading permission matrices.
Roles grant capabilities — not data. A role says what kind of work someone (or a Role Assistant) may request. Which records fall in scope is managed through dimensions and protection, not by inventing a role per data slice.
Business and management own the catalog. Development teams reuse those roles on applications and Connected Systems — they do not invent a parallel access model per system. Identity groups are already hard to govern; AI Fabrix intentionally avoids role and group sprawl inside every AI surface.
How it works
Onboarding seeds a minimal catalog
→ Business extends roles for real work
→ Groups bind people to roles
→ Role Assistants operate in the active role
| Layer | Meaning |
|---|---|
| Group | Who belongs (teams, departments, or platform groups such as AI Fabrix Developers) |
| Role | What capabilities they may use on the platform or as a Role Assistant — not which records they see |
| Role Assistant | Packaged around a catalog role — not a separate “AI role” inventing its own identity |
| Catalog | Single list in the Controller — extend for your enterprise; do not fork per system |
| Dimensions | Which records fall in scope — see Dimensions and protection |
Starter business roles (for example Sales Manager) are seeds, not a fixed contract of every job title. Rename, disable, or add roles when the business needs them. Full live inventory is always in the Role catalog in Miso Controller.
Platform roles in the same catalog
This table is the small product-owned set that unlocks platform work (administration, publish, observation, AI Trust, discovery, and baseline consume). Your industry and org-specific business roles belong in the same catalog — keep them few, meaningful, and assistant-ready.
| Role | Key | Typical group | What it gives you |
|---|---|---|---|
| Platform Admin | aifabrix-platform-admin |
AI Fabrix Platform Admins | Full platform administration — catalogs, apps, high-privilege operations |
| Security Admin | aifabrix-security-admin |
AI Fabrix Security Admins | Security administration and high-risk / identity-sensitive reviews |
| Infrastructure Admin | aifabrix-infrastructure-admin |
AI Fabrix Infrastructure Admins | Environments and infrastructure on the Controller |
| Deployment Admin | aifabrix-deployment-admin |
AI Fabrix Deployment Admins | Release and environment deployment orchestration |
| Compliance Admin | aifabrix-compliance-admin |
AI Fabrix Compliance Admins | Compliance monitoring and audit-oriented access |
| Developer | aifabrix-developer |
AI Fabrix Developers | Build, validate, and publish integrations and Runtime capabilities |
| Observer | aifabrix-observer |
AI Fabrix Observers | Read-only health, logs, and compliance visibility |
| AI Trust Operator | aifabrix-ai-trust-operator |
AI Fabrix AI-Trust-Operators | Run AI Trust evaluation and explain visibility |
| External System Discoverer | aifabrix-external-system-discoverer |
AI Fabrix External System Discoverers | Discover business context for Connected Systems |
| Business Transformation | business-transformation |
AI Fabrix Business Transformation | Built-in Role Assistant packaging for governed system building — not a substitute for Platform Admin |
| Everyone | aifabrix-everyone |
AI Fabrix Everyone | Consume enterprise LLM (call/embed) and platform search — no write or admin |
Everyone is for authenticated users who need models and search. It does not replace Connected System business RBAC or ABAC, and it is not a Role Assistant. Map users via the AI Fabrix Everyone group — do not list every business role on LLM or search systems.
One catalog — systems do not invent roles
Roles referenced on applications or Connected Systems must already exist in the catalog. Publish fails closed when a key is missing — so each system cannot create its own access reality.
How deploy and upload enforce that (and how to fix a failed probe) lives in Deployment and upload.
Example
After tenant activation, the catalog already includes AI Fabrix platform roles and a small set of starter business roles. Platform Admin binds the Developer role to the integration team and maps workforce users to Everyone. The business adds only the roles it will actually use for Role Assistants (for example Sales Manager). Assistants and Connected Systems reuse those same roles — they do not invent new ones at publish time.
Business value
A minimal, business-owned Role catalog keeps onboarding predictable, reduces role explosion, and gives Role Assistants a clear operating identity — quality of roles over quantity of keys.