> ## Documentation Index
> Fetch the complete documentation index at: https://ago.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Access Control for Multiple Teams

> Set up permission rules so different user groups see different agents and content

This guide shows you how to configure access control so different user groups (teams, tiers, regions) see different agents and content.

## Prerequisites

* Admin access to AGO
* An understanding of your user segments (who needs access to what)
* If using authenticated users: JWT token setup with user claims

<Steps>
  <Step title="Plan Your Permission Structure">
    Before configuring anything, map out your access model:

    | User Group     | Agents They Should See                  | Content Scope       |
    | -------------- | --------------------------------------- | ------------------- |
    | Free users     | FAQ Agent                               | Public docs only    |
    | Paid users     | FAQ Agent, Support Agent                | Full knowledge base |
    | Enterprise     | FAQ Agent, Support Agent, Account Agent | Full + custom docs  |
    | Internal staff | All agents                              | Everything          |

    <Tip>Start simple — you can always add more granularity later. Over-engineering permissions early creates maintenance overhead.</Tip>
  </Step>

  <Step title="Create Permission Groups">
    1. Navigate to **Settings** > **User Management**
    2. Create permission groups matching your access model (e.g., `free`, `paid`, `enterprise`)
  </Step>

  <Step title="Assign Agents to Permission Groups">
    1. Navigate to **AI Studio** > **Agents**
    2. Edit each agent
    3. Under **Access Control**, select the permission groups that should have access
    4. Click **Save**

    **Example:**

    | Agent         | Permission Groups            |
    | ------------- | ---------------------------- |
    | FAQ Agent     | `free`, `paid`, `enterprise` |
    | Support Agent | `paid`, `enterprise`         |
    | Account Agent | `enterprise`                 |

    See [Agent Permissions](../users/agent-permissions) for details.
  </Step>

  <Step title="Create Access Control Rules">
    Access control rules automatically assign users to permission groups based on their attributes (JWT claims, email domain, etc.).

    1. Navigate to **Settings** > **User Management** > **Access Control**
    2. Click **Add Rule**
    3. Define the condition and the resulting permission assignment

    **Example rules:**

    | Condition                               | Assigned Permission |
    | --------------------------------------- | ------------------- |
    | `plan == "free"`                        | `free`              |
    | `plan == "pro"` or `plan == "business"` | `paid`              |
    | `plan == "enterprise"`                  | `enterprise`        |
    | `email` ends with `@yourcompany.com`    | `internal`          |

    See [Access Control Rules](../users/access-control-rules) for all condition types and operators.
  </Step>

  <Step title="Test with User Impersonation">
    Verify your rules work correctly by impersonating different user types:

    1. Navigate to **Settings** > **User Management** > **Impersonation**
    2. Select a user profile or create a test profile with specific claims
    3. Verify that the correct agents are visible
    4. Test a conversation to confirm the right knowledge sources are available

    See [User Impersonation](../users/impersonate).

    <Note>Always test with real-world claim values to ensure your rules match correctly.</Note>
  </Step>
</Steps>

## Common Patterns

### Internal vs. External Users

Route by email domain:

| Rule                               | Permission                      |
| ---------------------------------- | ------------------------------- |
| Email ends with `@yourcompany.com` | `internal` (all agents)         |
| All other users                    | `external` (public agents only) |

### Regional Routing

Route by locale or region claim:

| Rule             | Permission                                    |
| ---------------- | --------------------------------------------- |
| `region == "eu"` | `eu-support` (EU-specific agents and content) |
| `region == "us"` | `us-support` (US-specific agents and content) |

### Free vs. Paid Tiers

Route by subscription plan:

| Rule                                | Permission                     |
| ----------------------------------- | ------------------------------ |
| `plan == "free"`                    | `basic` (FAQ agent only)       |
| `plan` is `"pro"` or `"enterprise"` | `premium` (all support agents) |

See [Access Control Examples](../users/access-control-examples) for more patterns.

***

## Troubleshooting

| Issue                   | Cause                             | Fix                                              |
| ----------------------- | --------------------------------- | ------------------------------------------------ |
| User sees no agents     | No matching access control rule   | Check rule conditions match the user's claims    |
| User sees wrong agents  | Rule assigns incorrect permission | Review rule priority and conditions              |
| Rules not evaluating    | JWT claims missing or malformed   | Verify token contains expected claims            |
| Anonymous users blocked | No default permission configured  | Create a fallback rule for unauthenticated users |

***

## Related

* [Access Control Rules](../users/access-control-rules) — rule configuration reference
* [Access Control Examples](../users/access-control-examples) — real-world rule patterns
* [Agent Permissions](../users/agent-permissions) — per-agent permission settings
* [User Impersonation](../users/impersonate) — testing access control
* [Widget & SDK Authentication](../security/widget-authentication) — JWT authentication setup