Roles

Default and custom roles in the AgentOS control plane.

Roles are named bundles of scopes assigned to users. Members inherit the scopes of every role assigned to them.

The roles on this page are managed in the AgentOS control plane. If you're running self-hosted, define roles in your identity provider or backend and include the appropriate scopes in the JWT.

Default Roles

The AgentOS control plane provides three default roles for organization members.

CapabilityOwnerAdministratorMember
Run agents, teams, workflows✓✓✓
Create and update AgentOS resources✓✓✓
Delete AgentOS resources✓✓
Create and update AgentOS instances✓✓✓
Delete AgentOS instances✓
Manage members and roles✓✓
Update organization settings✓✓
View billing✓✓✓
Update billing✓
Delete the organization✓

Custom Roles

Custom roles and scopes are available on the Enterprise plan. Book a call or email support@agno.com to enable.

Role permissions reach AgentOS through JWT scopes. Enable JWT authorization with authorization=True to enforce them; JWT authentication alone is insufficient. Service account token grants are enforced independently in every authentication mode.

Compose scopes into named roles in the AgentOS control plane and assign them to users in your organization.

Create a Custom Role

  1. Open the Roles page in the control plane.
  2. Define a role name and select the scopes it grants.
  3. Save the role.

Assign a Role to a User

Open the Organization settings page and assign the role to a user.

Next Steps

TaskGuide
See the full scope referenceScopes
Isolate data per userPer-User Data Isolation