Users & Roles
Users & Roles is where administrators manage who can sign in to AEGIS and what
they can do. You can find it at Admin > Users & Roles — click Admin in
the top bar (visible to administrators only), which opens the admin area at
/admin/users.
Users & Roles is admin-only. There is no self-serve signup anywhere in AEGIS — every account is created by an administrator.
The page shows the tenant’s user directory: email, display name, role chips, status, and creation date. Each user is in one of three states:
| Status | Meaning |
|---|---|
| Active | The user has set a password and can log in. |
| Invited | The account exists but the invite link has not been redeemed yet — login is not possible until it is. |
| Disabled | The account is deactivated. Login fails and any live sessions die within seconds. |
Creating a User (Invite Links)
Click Create user, enter the person’s email (and optionally a display name), and pick one or more roles. Creating the account produces a one-time invite link.
The invite link is shown once and cannot be recovered afterward — only a hash is stored. Copy it immediately and share it with the person over a trusted channel (there is no built-in email delivery). If the link is lost or expires, use Reset password to mint a new one.
The invitee opens the link, chooses a password, and is logged in. Invite links expire after 7 days; until redeemed, the account shows as Invited and cannot log in.
Roles
AEGIS ships four roles. A user can hold several at once (for example, a
reviewer who also runs day-to-day operations gets both reviewer and
operator) — grants are additive.
| Role | What it allows in the UI |
|---|---|
| Administrator | Everything below, plus: Users & Roles, Platform Settings, skill/prompt approvals, and deciding any HITL approval. |
| Power User | The Configuration section (entity/event types, skills, prompts, routers, policies, catalogs, evals), authoring skills and prompts, submitting filings, logging events, and running evals. |
| Reviewer | Deciding HITL approvals on the Filings and Approvals pages, plus read access to dashboards, conversations, and eval results. A deliberately pure role — reviewers who also do other work hold additional roles. |
| Operator | Day-to-day use: dashboards, conversations, submitting filings, logging operational events, and proposing skills (a draft an author or admin then takes forward — operators cannot author directly). |
The full permission-by-role matrix lives in the developer auth-flow page. Note what the sidebar shows follows your roles: the Configuration section appears for Power Users and Administrators; Users & Roles, Platform Settings, and approval queues are admin-only.
Changing Roles
Use the row menu’s Edit roles. Changes take effect on live traffic within
about 5 seconds — the person does not need to log out and back in. A user
must always hold at least one role, and you cannot remove the admin role
from the last remaining active administrator.
Deactivating and Reactivating
Deactivate (row menu) disables the account: login fails immediately and any sessions the person has open die within ~5 seconds, on every device.
Accounts are never deleted — deactivation is the removal path. This keeps the audit trail intact: every past action stays attributable to a real account. Reactivate restores access at any time. The last active administrator cannot be deactivated.
Password Resets
Reset password (row menu) mints a one-time reset link (1-hour expiry) and immediately revokes the user’s live sessions and any previously issued invite or reset links. Like invite links, the reset link is shown once — copy it and share it out-of-band. Passwords are stored only as hashes and can never be looked up, so a reset link is the only recovery path for a forgotten password.