Roles and Permissions

Overview

The Roles and Permissions page provides a structured approach to Role-Based Access Control (RBAC) that lets administrators define and manage user access based on predefined roles. Each role is associated with a set of permissions, ensuring that users can perform only the actions permitted within their assigned roles.

Additionally, the Roles and Permissions page allows administrators to assign system roles (roles) to an IdP role, providing seamless integration with external identity providers. An Identity Provider (IdP) system manages user identities and authentication, letting organizations implement Single Sign-On (SSO) and centralized access control across multiple applications. This integration ensures consistent role management and secure user access across all connected services.

note

A set of available permissions corresponds to Jobs. For example, the following two actions are Jobs, which in turn are permissions that can be given to a role:

• Add a Collection
• Delete a Collection

Access the Roles and Permissions page

To access the Roles and Permissions page:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. In the System Dashboard navigation menu, click Roles and permissions.

Roles

Create a role

To create a new role:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. Click + New role.
5. In the Role name box, enter a name for the new role.
6. Optional: In the Description box, enter a description for the new role.
7. In the Permissions section, select the permissions for the new role.
   note

   To learn about the available permissions, see Permissions.

8. Click + Create.

Update a role

To update a role:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. In the Roles table, click the role you want to update.
5. Update the previously defined permissions.
6. Click Update.

Delete a role

To delete a role:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. In the Roles table, click the role you want to delete.
5. Click Delete.
6. In the Delete role card, click Delete.

Manage the default role

The default role is automatically assigned to every new non-guest user when they sign in for the first time. It determines which permissions a newly registered user receives without any administrator intervention.

Enterprise h2oGPTe includes a built-in role named default that has the most common permissions pre-enabled and is assigned to new users on first login.

Identify the default role

In the Roles table, the role currently used as the default displays a green default badge. System roles such as admin and viewer display a blue locked badge and cannot be deleted.

Change the permissions granted to new users

caution

Requires the Manage roles permission.

To change which permissions new users receive on first login, edit the role that is currently marked as the default:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. In the Roles table, click the role with the green default badge.
5. Adjust the Permissions as needed: remove any permissions that should not be granted to new users automatically, and add any that should.
6. Click Update.

note

Changes to the default role's permissions take effect immediately for all users who hold that role. To assign the default role to existing users who don't have it, use the Assign a role to a user workflow below.

Constraints

• The role currently marked as the default is protected from deletion.
• Guest users are never assigned the default role; they always receive the built-in guest role.
• The UI does not support changing which role is designated as the default. To designate a different role, contact your system administrator.

Assign a role to a user

To assign a (created) role to a user:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. In the User Permissions table, locate/search for the user you want to assign a role to.
5. In the Roles list, select a role.

IdP roles

Assign a role to an IdP role

To assign a (created) role to an IdP role:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. Click + Add role mapping.
5. In the IDP Role Name box, enter an IdP role name.
   caution

   Enter a valid existing IdP role name.

6. In the Optional description box, enter a description for the IdP role.
7. Click Add.
8. In the IDP Roles to Internal Roles Mapping table, locate/search for the IdP role you want to assign a role.
9. In the Roles list, select a role.
   note

   To learn about the available permissions, see Permissions.

Delete an assigned role to an IdP role

To delete an assigned role to an IdP role:

1. In Enterprise h2oGPTe, click account_circle Account Circle.
2. Select System Dashboard.
3. In the System Dashboard navigation menu, click Roles and permissions.
4. In the IDP Roles to Internal Roles Mapping table, click the checkbox of the assigned role to an IdP role you want to delete.
5. Click Delete.
6. In the Are you sure? box, click Delete.

Permissions

Permissions are organized into 16 categories: Admin, Display, Collections, Chats, Documents, Prompt Templates, Agents, Custom Agents, Custom Agent Tools, API Keys, Data Connectors, Document AI, Memory Blocks, Scheduled Tasks, AI Assistants, and Forums.

When creating or editing a role, select the permissions you want to assign from these categories in the Permissions section of the role editor.

For the complete permissions catalog with identifiers, per-role defaults, and API management, see Roles and Permissions Reference.

---

Feedback

• Submit and view feedback for this page
• Send feedback about Enterprise h2oGPTe to cloud-feedback@h2o.ai