Skip to main content
This guide shows you how to configure access control so different user groups (teams, tiers, regions) see different agents and content.

​
Prerequisites

  • Admin access to AGO
  • An understanding of your user segments (who needs access to what)
  • If using authenticated users: JWT token setup with user claims
1

Plan Your Permission Structure

Before configuring anything, map out your access model:
Start simple — you can always add more granularity later. Over-engineering permissions early creates maintenance overhead.
2

Create Permission Groups

  1. Navigate to Settings > User Management
  2. Create permission groups matching your access model (e.g., free, paid, enterprise)
3

Assign Agents to Permission Groups

  1. Navigate to AI Studio > Agents
  2. Edit each agent
  3. Under Access Control, select the permission groups that should have access
  4. Click Save
Example:See Agent Permissions for details.
4

Create Access Control Rules

Access control rules automatically assign users to permission groups based on their attributes (JWT claims, email domain, etc.).
  1. Navigate to Settings > User Management > Access Control
  2. Click Add Rule
  3. Define the condition and the resulting permission assignment
Example rules:See Access Control Rules for all condition types and operators.
5

Test with User Impersonation

Verify your rules work correctly by impersonating different user types:
  1. Navigate to Settings > User Management > Impersonation
  2. Select a user profile or create a test profile with specific claims
  3. Verify that the correct agents are visible
  4. Test a conversation to confirm the right knowledge sources are available
See User Impersonation.
Always test with real-world claim values to ensure your rules match correctly.

​
Common Patterns

​
Internal vs. External Users

Route by email domain:

​
Regional Routing

Route by locale or region claim:

​
Free vs. Paid Tiers

Route by subscription plan: See Access Control Examples for more patterns.

​
Troubleshooting