> Source: https://builder-docs.ema.ai/administration/governance-permissions > Title: Governance, Access & Permissions # Governance, Access & Permissions Access control in Ema uses predefined roles (bundles of permissions) and permission bits (atomic actions) across three object levels: **Workspace**, **AI Employee**, and **Project**. You can assign preset roles but cannot create, edit, or delete roles or permission bits. * * * ## Key Concepts Term Definition **Workspace** Your organization's container in Ema. Workspace roles can cascade down to all AI Employees and Projects inside it. **AI Employee** An AI worker configured for a specific purpose. AI Employee roles control who can view, build, manage users, and create Projects. **Project** Work artifacts under an AI Employee. Project roles control who can view, edit, and share a single project. Not all AI Employees have Projects -- today their usage is restricted to Document Generation and Recruiter type AI Employees. **Role** A tier that a user holds for a Workspace, AI Employee, or Project. **Permission bit** A single capability (e.g., _invite users_, _edit workflow canvas_). Roles are collections of these bits. **Preset roles only** Roles and permission bits are centrally defined. Builders **use** them; builders do **not** customize them. **Inheritance** A higher-level role can implicitly grant appropriate access at lower levels. For example, a qualifying Workspace role implies AI Employee access; some Project roles imply minimal AI Employee access so users can operate the project. * * * ## Object Levels - **Workspace** -- Use for organization-wide responsibilities (invite users, create AI Employees, see settings and metrics). When a Workspace role implies AI Employee access, it applies to _all_ AI Employees in that Workspace. - **AI Employee** -- Use when a person needs to build or manage _one_ AI Employee (including its users, canvas, and evaluations) and create Projects beneath it. - **Project** -- Use when a person only needs access to _one_ Project. There is a single role at this level (Project User) which has all necessary permissions and is automatically assigned. Project roles automatically grant minimal AI Employee access. * * * ## Role Catalog Ema provides eight preset roles across the three levels: Level Role Primary Intent Workspace Workspace Admin Full workspace administration Workspace Workspace Manager Manage people and settings without full admin Workspace Workspace Builder Create and organize AI Employees Workspace Workspace Guest Minimal workspace access AI Employee AI Employee Admin (PERSONA\_ADMIN) Full control of one AI Employee AI Employee AI Employee Manager (PERSONA\_WRITE) Manage AI Employee users and settings AI Employee AI Employee Project User (PROJECT\_WRITE) Access to work within projects under an AI Employee Project Project User Full access to work within a single project * * * ## Permission Matrices ### Workspace Permissions Permission Bit Description Admin Manager Builder Guest Create AI Employees Create new AI Employees in the workspace Y \-- Y \-- Invite Users Send invitations to add users Y Y \-- \-- Change User Permissions Modify other users' role assignments Y Y \-- \-- Remove Users Remove users from the workspace Y Y \-- \-- View Tenant Metrics View workspace-level analytics Y Y \-- \-- View Workspace Settings View workspace configuration pages Y Y \-- \-- View Audit Logs View audit and activity logs Y \-- \-- \-- Create Template from AI Employee Convert an AI Employee into a reusable template Y \-- \-- \-- Create Child Tenant Create a child workspace Y \-- Y \-- Manage Flags Manage feature/configuration flags Y \-- \-- \-- Manage Template List Manage available templates Y \-- \-- \-- Manage Persona Groups Organize AI Employees into groups Y Y Y \-- **Default AI Employee role** Auto-granted for all AI Employees AI Employee Admin AI Employee Manager _No default_ _No default_ ### AI Employee Permissions Certain Workspace roles automatically grant AI Employee roles. Workspace Admin implies AI Employee Admin; Workspace Manager implies AI Employee Manager. These inherited permissions apply across all AI Employees in the workspace. Permission Bit Description Admin Manager Project User View AI Employee View configuration Y Y Y Edit AI Employee Edit configuration and settings Y N \-- Use AI Employee Run the AI Employee Y Y Y Share AI Employee Share with others Y Y \-- Delete AI Employee Delete the AI Employee Y \-- \-- Rename AI Employee Rename the AI Employee Y Y \-- Change Status Enable/disable the AI Employee Y Y \-- View Users View all users with access Y Y \-- Add Users Grant users access Y Y \-- Remove Users Revoke users' access Y Y \-- Edit User Permission Change another user's role Y Y \-- View Workflow Canvas View the workflow canvas Y Y Y Edit Workflow Canvas Edit the workflow canvas Y \-- \-- Run Evaluations Run evaluations on the AI Employee Y \-- \-- View Metrics View AI Employee-level analytics Y Y \-- View Training & Logs View training artifacts and logs Y Y \-- Create Project Create a new Project under this AI Employee Y Y Y Doc Writer - Restore Section Restore a previous Doc Writer section version Y Y \-- Doc Writer - Approve Section Approve a Doc Writer section Y Y \-- ### Project Permissions Some AI Employee roles automatically grant Project access. AI Employee Admin and AI Employee Manager imply appropriate Project-level access where needed; Project roles may also come with minimal AI Employee access so users can operate the project. Permission Bit Description Project User View Project View project artifacts and configuration Y Edit Project Edit project artifacts and configuration Y View Users in Project View who has access Y Share Project Share with others Y Remove User from Project Remove a user from the project Y View Parent AI Employee View the parent AI Employee's configuration Y * * * ## How to Use 1. **Choose the level.** Decide whether access belongs at the Workspace, AI Employee, or Project level. Default to the lowest level that satisfies the need. 2. **Pick the preset role.** Match responsibilities to a role using the catalog above. - Use a **Project** role for single-project contributors. - Use **AI Employee Manager** for workflow managers or **AI Employee Project User** for project contributors. - Use **Workspace Admin** or **Workspace Manager** for workspace-wide operations. * * * ## Related Pages - [User Management](/legacy-docs/administration/user-management) -- Inviting users and assigning roles in the UI. - [Workspaces & Tenants](/legacy-docs/administration/workspaces-tenants) -- Tenant-level roles and hierarchical access. - [AIE Audit Log](/legacy-docs/administration/audit-log) -- Track changes to AI Employee configurations.