Overview

Roles are embedded in JWT claims. Multiple roles per user are supported — passing multiple roles means any of those roles is sufficient. Roles are enforced at the FastAPI dependency layer on every endpoint.

Platform Roles

Four built-in roles cover all platform access patterns.

Role	Capabilities
admin	All operations — user management, key rotation, IdP config, workspace creation
ops	Deploy models, approve HITL requests, configure clusters, manage IP allowlist
legal	Approve/reject GitOps manifests and HITL requests, view compliance reports, download audit packages
dev	Create/read models, run agents, view audit log, submit evals

Machine-to-Machine Access

CI/CD pipelines, the MCP Server, and the AI Governance Agents all authenticate with Personal Access Tokens (PATs). Issue a PAT with the minimum required role — ops for agents and MCP, dev for read-only CI tasks.

bash

Issue a PAT

curl -X POST https://sovereign.yourcompany.com/api/v1/auth/tokens \
  -H "Authorization: Bearer $OIDC_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "name": "agent-m2m", "role": "ops", "expires_in_days": 365 }'