Roles and capabilities

Access is governed by capabilities (named permissions) grouped into roles assigned to users. Ajutant ships these system roles; administrators can also create custom roles.

System roles at a glance

Role	What it can do
Power User	Everyday use: chat, documents, forms. No admin capabilities.
Assistant Creator	Build and manage assistants they own.
Reporting User	View reporting: usage, costs, ROI, billing, feedback. No admin console.
Approver	Approve or reject changes submitted for approval.
Client Admin	Manage the platform: assistants, chatbots, models, knowledge, connections, users, teams, directories, roles, governance, distribution, settings, plus all reporting.
Platform Admin	Everything (a super-role that implies all capabilities).

Capabilities

A capability unlocks one admin area or action, and the same capability gates both what you see and what the API allows, so visibility always matches access. Examples: manage_assistants, manage_governance, manage_models, manage_users, manage_roles, view_reporting, view_licenses.

Custom roles

A Client Admin can create a custom role with exactly the capabilities it needs, then assign it to users. This is how you fit access to your own structure rather than the system roles alone. See Users, teams, and roles.