Skip to main content
This guide shows you how to configure access control so different user groups (teams, tiers, regions) see different agents and content.

​
Prerequisites

  • Admin access to AGO
  • An understanding of your user segments (who needs access to what)
  • If using authenticated users: JWT token setup with user claims
1

Plan Your Permission Structure

Before configuring anything, map out your access model:
Start simple — you can always add more granularity later. Over-engineering permissions early creates maintenance overhead.
2

Create Permission Groups

  1. Navigate to AI Studio > Permissions
  2. Click Create Permission and create permissions matching your access model (e.g., free, paid, enterprise)
3

Assign Agents to Permission Groups

  1. Navigate to AI Studio > Agents
  2. Edit each agent
  3. Under Access Control, select the permission groups that should have access
  4. Click Save
Example:See Agent Permissions for details.
4

Create Access Control Rules

Access control rules automatically assign users to permission groups based on their attributes (JWT claims, email domain, etc.).
  1. Navigate to AI Studio > Permissions
  2. Select JWT-based permissions and click Add JWT Rule for JWT claims, or open Email-based permissions to configure email and domain rules
  3. Define the condition and select the permissions to grant
Example rules:See Access Control Rules for all condition types and operators.
5

Test with Representative Users

Verify the complete authentication and rule-matching flow with test accounts:
  1. Sign in to your widget or portal with a non-admin test account for each user group
  2. For JWT rules, have your authentication service issue a valid token containing the intended claims
  3. Verify that the expected agents are available and unintended agents are inaccessible
  4. Start a conversation to check the available knowledge sources
The permission selector can preview a permission’s agent list, but it does not impersonate another identity or replace testing the user’s JWT claims.
Always test with real-world claim values to ensure your rules match correctly.

​
Common Patterns

​
Internal vs. External Users

Route by email domain:

​
Regional Routing

Route by locale or region claim:

​
Free vs. Paid Tiers

Route by subscription plan: See Access Control Examples for more patterns.

​
Troubleshooting