Roles
Roles define what a user or API client is allowed to do in Vince Platform. Rather than assigning permissions directly to individuals, you create a role with a specific permission set and then assign users or API clients to that role.
The roles list
| Column | Description |
|---|---|
| Role Name | The display name of the role |
| Users | Number of users currently assigned to this role |
| Permissions | Number of permission entries configured on this role |
| Active | Whether the role is currently in use |
How roles work
Each permission entry on a role combines an App, a Resource, a Resource Name and a Permission. The Permission column offers these actions:
| Permission | What it allows |
|---|---|
| All | Every action on the resource, including administrative actions |
| Read | View the resource — no changes permitted |
| Write | View and modify the resource |
Resources of type App (for example, applications built with App Builder) additionally offer Run, Deploy and Deny.
AI permissions
The AI Apps app has these resources:
| Resource | Controls |
|---|---|
| App | Individual AI applications (Read, Run, Write, Deploy, Deny) |
| MCP Server | The MCP servers configured for the tenant |
| Tenant Prompt | The tenant-wide AI prompt |
| MCP tool permission | Which MCP tools may be used. Only offered if the tenant has MCP servers |
Read is needed to view MCP servers, the tenant prompt and MCP tool permissions. Write is needed to add or edit them and to change the tenant prompt.
A user with no role assigned has no access to any part of the platform. A user can hold multiple roles — their effective permissions are the union of all assigned roles.
Creating a role
- Click + New Role.
- Enter a descriptive Role Name.
- Add permissions by selecting the resource type and the access level.
- Click Save.
- Assign users to the role — either with Assign users on the role (see below) or by editing each user.
Name roles after their business function rather than their technical permissions — for example, "Pricing Admin" or "Warehouse Viewer" rather than "Write Access Group 3". This makes access audits significantly easier.
Assigning users to a role
Open a role and click Assign users to change it for many users at once (needs Write access to users).
- Choose what to do: Add this role (keeps the users' other roles), Remove this role, or Replace all roles with this one.
- Select the users. Search users… narrows the list, Select visible picks everyone shown, and Select with role picks those who already have the role.
- Click the button at the bottom. It shows how many users will be changed.
Replace all roles with this one cannot be undone, because the selected users lose every other role they hold. You are asked to confirm first.
If some users fail, the dialog tells you and keeps them selected so you can retry.
Further reading
- Users — assign roles to user accounts
- API Clients — roles are also assigned to API clients for programmatic access
- Groups — workflow groups use roles to control which users see which workflows in VXL Live