Table of Contents

Permissions & Roles Reference

Reference for the built-in FoundationaLLM roles, scopes, and authorizable actions that control what users can do in the Management Portal.

Overview

FoundationaLLM uses role-based access control (RBAC) modeled on Azure RBAC:

  • A role definition is a named set of authorizable actions.
  • A role assignment grants a role to a principal (user, group, or service principal) at a scope.
  • An authorizable action has the form {ResourceProvider}/{resourceType}/{operation}, where the operation is read, write, or delete.

Some operations also check for a specific role, in addition to (or instead of) an authorizable action. These are described in Roles that resource providers check.

Role assignments are managed on the Security > Access Control page. See Instance Access Control. For a per-resource permission matrix, see the FoundationaLLM Permissions Reference.

Built-in roles

All built-in roles are assignable at any scope.

General roles

Role ID Actions
Owner 1301f8d4-3bea-4880-945f-315dbd2ddb46 * (all actions, including role assignments)
Contributor a9f0020f-6e3a-49bf-8d1d-35fd53058edf *, except FoundationaLLM.Authorization/*/write and FoundationaLLM.Authorization/*/delete
Reader 00a53e72-f66e-4c03-8f81-7e885fd2eb35 */read
User Access Administrator fb8e0fd0-f7e2-4957-89d6-19f44f7d6618 */read, FoundationaLLM.Authorization/*
Role Based Access Control Administrator 17ca4b59-3aee-497d-b43b-95dd7d916f99 Read, write, and delete role assignments and policy assignments; read role definitions and policy definitions
Resource Providers Administrator 63b6cc4d-9e1c-4891-8201-cf58286ebfe6 */management/write
Security Principals Reader 6fbf9db9-8e0e-4337-be05-58a3d6f2eda3 FoundationaLLM.Authorization/securityPrincipals/read

Specialized roles

Role ID Actions granted by the role definition
Agents Contributor 3f28aa77-a854-4aa7-ae11-ffda238275c9 Read tools, tool families, and tool sets
Agent Access Tokens Contributor 8c5ea0d3-f5a1-4be5-90a7-a12921c45542 None
Prompts Contributor 479e7b36-5965-4a7f-baf7-84e57be854aa None
Tools Reader 9599b446-a7a5-4cc3-a06a-5cf845e83187 Read tools, tool families, and tool sets
Tools Contributor 33e9200a-b6e3-4242-bb40-4d90abd92eea Read and write tools, tool families, and tool sets
Data Sources Contributor 78ee11d9-6e6a-4adc-8c16-3613e7445113 None
Knowledge Sources Contributor 8eec6664-9abf-4beb-84f7-18d9c2917c7f None
Knowledge Units Contributor 5f38b653-e3b7-47a8-8fde-e70ea9e4fa91 None
Vector Databases Contributor c026f070-abc2-4419-aed9-ec0676f81519 Read API endpoint configurations
Data Pipelines Contributor 2da16a58-ed63-431a-b90e-9df32c2cae4a Read API endpoint configurations, AI models, and plugins
Data Pipelines Execution Manager e959eecb-8edf-4442-b532-4990f9a1df2b Read and write data pipelines; read data sources, API endpoint configurations, AI models, plugin packages, plugins, and vector databases
Attachments Contributor 8e77fb6a-7a78-43e1-b628-d9e2285fe25a Read and write attachments and Azure OpenAI conversation and file mappings; read API endpoint configurations and AI models
Conversations Contributor d0d21b90-5317-499a-9208-3a6cb71b84f9 Read and write conversations and Azure OpenAI conversation mappings; read API endpoint configurations and AI models
Analytics Reader f3ab7cdd-d0c3-43d1-84d7-7409305e0c4a Read analytics, conversation analytics, and context analytics
Quotas Contributor 2529ca9f-9c8e-45dd-9421-685113c086ad FoundationaLLM.Quota/*
Configuration Contributor 5dd9a1bb-c11b-4e2d-860c-690ec4e7bcd1 None
Managed Deployments Admin 52193588-ce65-4415-a89d-38399ed481e6 Read, write, and delete managed endpoint deployments
Sandboxes Contributor a8f3e2d1-4c5b-6a7e-8f9d-0e1f2a3b4c5d Read, write, and delete sandboxes
Sandboxes Admin b9e4f3a2-5d6c-7b8e-9f0a-1b2c3d4e5f6a Read, write, and delete sandboxes; manage sandbox node pools, classes, policies, and configurations; read sandbox container images

Roles that resource providers check

Several specialized roles grant few or no actions on their own. Instead, resource providers check for them on specific operations.

Roles that allow creating resources

With these roles, a user can create a new resource of the given type without having write permission at that scope. The role does not grant access to existing resources.

Role Allows
Agents Contributor Creating agents (including from agent templates)
Prompts Contributor Creating prompts
Data Sources Contributor Creating data sources
Knowledge Sources Contributor Creating knowledge sources
Knowledge Units Contributor Creating knowledge units
Vector Databases Contributor Creating vector databases

Roles that are required in addition to permissions

For these operations, the role is mandatory: an Owner or Contributor without the role is denied.

Role Required for
Data Pipelines Contributor Creating and updating data pipelines
Agent Access Tokens Contributor Creating and updating agent access tokens
Tools Contributor Creating and updating tools, tool families, and tool sets
Configuration Contributor Writing app configuration values
Conversations Contributor Creating agent tasks and agent task runs
Quotas Contributor All quota, quota metric, and quota event operations
Analytics Reader Running analytics queries
Managed Deployments Admin All managed endpoint deployment operations
Sandboxes Admin Managing sandbox node pools, classes, policies, and configurations, and reading sandbox container images
Role Based Access Control Administrator The Check Access action on the Role Assignments page
Resource Providers Administrator Resource provider management commands (management/trigger-command)

The Data Pipelines Execution Manager role is checked for data pipeline run operations. Because it also grants FoundationaLLM.DataPipeline/dataPipelines/write, holders can view and manage runs. See RBAC Roles and Permissions for Data Pipelines.

Owner assignment on new resources

When a user creates a resource, FoundationaLLM assigns that user the Owner role on the new resource. This doesn't happen when a policy applies to the resource, for authorization resources, or for subordinate resources (such as agent files).

Scopes

On the Access Control page, you choose one of these scope types:

Scope type Applies to
Instance All resources in the FoundationaLLM instance (/instances/{instanceId}).
Portal Access Access to the User Portal, Management Portal, or Agent Portal. Only the Reader role can be assigned. See Management Portal Access.
Resource A single resource, identified by resource provider, resource type, and resource name (for example, /instances/{instanceId}/providers/FoundationaLLM.DataPipeline/dataPipelines/{name}).

Role assignments are inherited: an assignment at the instance scope applies to every resource in the instance.

Authorizable actions

Actions follow the pattern {ResourceProvider}/{resourceType}/{operation}. Every resource provider also has a management/write action for management commands.

Resource provider Resource types (operations)
FoundationaLLM.Agent agents, workflows, tools, agentTemplates, agentTasks, toolFamilies, toolSets (read, write, delete)
FoundationaLLM.AIModel aiModels (read, write, delete)
FoundationaLLM.Analytics analytics (read)
FoundationaLLM.Attachment attachments (read, write, delete)
FoundationaLLM.Authorization roleAssignments, policyAssignments (read, write, delete); roleDefinitions, policyDefinitions, securityPrincipals (read)
FoundationaLLM.AzureAI agentConversationMappings, agentFileMappings, projects (read, write, delete)
FoundationaLLM.AzureOpenAI conversationMappings, fileMappings (read, write, delete)
FoundationaLLM.Configuration appConfigurations, keyVaultSecrets, apiEndpointConfigurations (read, write, delete); appConfigurationSets (read)
FoundationaLLM.Context knowledgeSources, knowledgeUnits, memories (read, write, delete); files, fileOperations, contextAnalytics (read)
FoundationaLLM.Conversation conversations (read, write, delete); conversationAnalytics (read)
FoundationaLLM.DataPipeline dataPipelines (read, write, delete)
FoundationaLLM.DataSource dataSources (read, write, delete)
FoundationaLLM.Platform artifactPackages, plugins, pluginPackages, managedEndpointDeployments, sandboxes, sandboxClasses, sandboxPolicies, sandboxConfigurations (read, write, delete); sandboxNodePools (read, write); logs, sandboxContainerImages (read)
FoundationaLLM.Prompt prompts (read, write, delete)
FoundationaLLM.Quota quotas (read, write, delete); quotaEvents (read, write); quotaMetrics (read)
FoundationaLLM.User userProfiles (read, write)
FoundationaLLM.Vector vectorDatabases (read, write, delete)

The FoundationaLLM.Attachment and FoundationaLLM.User providers have no management/write action. The list of authorizable actions also contains legacy FoundationaLLM.Vectorization actions; no current resource provider uses them.

Wildcards

Built-in roles use these wildcard patterns:

Pattern Meaning
* All actions
*/read All read actions
*/management/write Management actions on all resource providers
FoundationaLLM.Authorization/* All authorization actions
FoundationaLLM.Quota/* All quota actions