> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/core-concepts/roles-and-permissions.md).

# Roles & Permissions

AOH Sync uses role-based access control to determine what each user can see and do. Permissions are granted through **permission groups** — named sets of roles that you assign to users.

## How access decisions work

Every permission check in AOH Sync is made on the server, on every request — the interface reflects what the backend permits, and never grants access on its own. This means:

* If your access is revoked, the next request is denied immediately. There is no window where the UI still shows a permitted action after the backend has revoked it.
* You cannot gain access by navigating directly to a URL or manipulating the interface; the backend is always the authority.
* When your group membership changes, the change takes effect on the next request — no sign-out or cache-clear needed.

If someone has access they should not, the fix is in the permission group model — in one place — and takes effect immediately.

## Built-in permission groups

AOH Sync ships with five system-defined permission groups. You can view and manage them from the **Access Management** screen under Administration.

| Group                    | What it grants                                                                    |
| ------------------------ | --------------------------------------------------------------------------------- |
| **Global Administrator** | Unrestricted access to all system features and administration                     |
| **System Administrator** | System operations including configuration, Connectors, scheduling, and monitoring |
| **Analyst**              | Read-only access to dashboards, lifecycle data, and provisioning status           |
| **Enterprise Resources** | HR-facing access to Connectors, user lifecycle, and attribute information         |
| **Security**             | Audit logs, secrets management, user lock/unlock, and service monitoring          |

![The Access Management screen showing five system permission groups — Analyst, Enterprise Resources, Global Administrator, Security, and System Administrator — with their descriptions and role counts. The Analyst role matrix is expanded below, showing 6 of 22 system roles granted.](/files/vobaOPDdLZuEP2YD4UVN)

*The Access Management screen. Each group row shows the number of granular roles it includes. Expand a group to see its full role matrix.*

## Granular roles

Each permission group is made up of individual system roles. There are 22 system roles in total, covering areas such as:

* Dashboard access and reports generation
* Connector management and schedule management
* Provisioning status and Entra log access
* Attribute information and user lifecycle access
* User management and user lock/unlock
* Secrets management and Vault administration
* Audit log access and service monitoring

The full role matrix for any group is visible on the Access Management screen by selecting the group and clicking **View full matrix**.

{% hint style="info" %}
System permission groups cannot be deleted. You can create custom groups with any combination of the 22 system roles to match your organization's access model.
{% endhint %}

## Assigning users to groups

User-to-group assignments are managed from the **User Management** screen under Administration. A user can belong to multiple permission groups; their effective permissions are the union of all roles granted by every group they belong to.

{% hint style="info" %}
Every permission change is recorded in the audit trail — including who made the change, what was modified, and when it took effect.
{% endhint %}

## Related

* [Access Management](/administration/access-management.md)
* [User Management](/administration/user-management.md)
* [Audit & Status Logs](/administration/audit-and-status-logs.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/core-concepts/roles-and-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.