tvaras.ai

Permissions

Fine-grained control over which tools each user can access. Permissions are organized by tool category with role-based and per-user overrides.

How Permissions Work

When a user invokes a tool, the system checks permissions in this order:

  1. Always-allowed tools — basic tools like conversation recall are always permitted
  2. Gateway tools — tool activation commands are always permitted
  3. Super-admin-only categories — only super_admin users can access (e.g. bot introspection)
  4. User type — super_admin and admin have full access
  5. Per-user overrides — explicit grants or denials for specific users
  6. Role grants — union of all assigned role permissions (any grant wins)
  7. Defaults — read tools: allowed, write tools: denied

Tool Categories

Tools are grouped into categories. Each category has read and write permissions:

  • BigQuery — SQL queries and schema exploration
  • dbt — model browsing, editing, lineage
  • Git/Files — repository browsing and file operations
  • Google Ads — ad account queries and management
  • Meta Ads — Facebook/Instagram ads data
  • Jira — issue tracking operations
  • Slack — messaging and channel operations
  • Lightdash — BI dashboard operations
  • Google Workspace — Drive, Docs, Sheets
  • Tasks — task creation and management
  • Charts — data visualization
  • Web Browsing — internet search and page fetching
  • And more (Calendar, Iterable, Linear, ShipHero, etc.)

Permission Roles

Create custom roles that bundle permissions together, then assign them to users. A user can have multiple roles — permissions are merged (any grant wins).

Example roles:

  • Analyst — read access to BigQuery, dbt, Charts
  • Marketing — read access to Google Ads, Meta Ads, Charts
  • Engineer — read + write access to dbt, Git, BigQuery

Admin Panel

Go to Admin → Permissions to:

  • View and edit permission roles
  • Create new roles with category-level or tool-level permissions
  • Assign roles to users
  • Set per-user overrides (grant or deny specific tools)
  • View effective permissions for any user

Default Permissions

For regular user type accounts without any role assignments:

  • Read tools — allowed by default (queries, browsing, listing)
  • Write tools — denied by default (creating, editing, deleting)

Admins and super admins bypass all permission checks.