> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/concepts/roles-and-permissions.md). # Roles and Permissions Cakewalk Agent Access has two roles: Admin and Member. This page defines what each can do. Cakewalk Agent Access uses two roles: **Admin** and **Member**. Every User has exactly one. *** ### 📖 Key Concepts * **Admin**: Configures and operates Cakewalk Agent Access. Manages every Agent, Connection, User and Policy across the organization. * **Member**: The day-to-day role for everyone who isn't an Admin. Employees with this role connect to third-party apps, set up Agents and respond to approval prompts. :bulb: *Why this matters:* Your role determines what you see when you log in and what actions you can take. Admins configure governance for the organization; Members manage their own Connections, Agents and approval prompts. *** ### 🛠 Admin Capabilities An Admin can: * View the org-wide Dashboard and Agent Activity * Manage Connections (add to catalog, suspend, remove from governance) * Set [Connection access](/docs/ai-agent-access/how-to-guides/connection-access.md) to Open or Curated, and choose which Agent Connections each User Group is allowed * Manage Agents (pre-register, suspend, restrict, restore, unrestrict) * Manage Users (invite, edit attributes, end sessions, revoke connections, remove) * Author and activate [Policies](/docs/ai-agent-access/concepts/policies.md) * Inspect the [The Tool Call Record](/docs/ai-agent-access/concepts/audit-log.md) for any session in the organization User attribute edits are available only when HRIS sync is not configured. When HRIS sync is active, User attributes flow from your company's HRIS or IdP and are read-only across the product. Admins are typically the CISO, the security team or the IT lead who owns AI agent governance. *** ### 🛠 Member Capabilities A Member can: * Connect to third-party apps (Connections) the Admin has added to the catalog. Under Curated Connection access, only the ones allowed for the groups they belong to * Set up Agents through the MCP Gateway * Receive and respond to MCP elicitation prompts when an action requires approval * See their own Connections and Agents and the status of each * See and edit their Profile Settings (HRIS-synced fields are read-only) Members do not see other Members' Connections, Agents or sessions. They cannot create Policies. They cannot pre-register, suspend or restrict Agents: those are Admin-driven lifecycle states. They cannot resume a Connection that is Restricted, because what their groups are allowed is an Admin setting. *** ### Related Concepts * [The Three Actors](/docs/ai-agent-access/concepts/the-three-actors.md): how Users (the people behind these roles) fit into the governance model * [Connection and Agent Statuses](/docs/ai-agent-access/concepts/connection-and-agent-statuses.md): the admin-set vs. system-detected states Admins manage * [Connection Access](/docs/ai-agent-access/how-to-guides/connection-access.md): how Admins limit which Agent Connections each group can use --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/concepts/roles-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.