Users and access
This page explains how people gain access to Bevaya, how they sign in, and how roles and the platform hierarchy determine what each user can do. Read Platform hierarchy first if you haven't — access in Bevaya is layered on top of the organization, workspace, and AI Agent structure described there.
How access works
Access in Bevaya combines three things:
- Membership — a user belongs to your organization (your tenant).
- A role — the role assigned to a user determines what they can do, such as building AI Agents, running them, or reviewing items.
- Workspace and AI Agent access — determines where a user can do it, by granting them access to specific workspaces and AI Agents.
A user's capabilities are the intersection of these: their role applied within the workspaces and AI Agents they can reach, inside your organization's boundary.
Signing in
Users sign in to Bevaya with single sign-on (SSO) through your organization's identity provider. Signing in authenticates who a user is; it does not by itself grant any capabilities — those come from the role and access assigned to the user (see Authentication and authorization below).
Configuring your identity provider is handled together with the Bevaya team as part of onboarding.
Roles
Bevaya provides three standard roles. Each role is a defined set of permissions; you assign a role to a user to grant the corresponding capabilities.
Admin — full access across the platform. Admins manage the organization and its settings, configure enterprise identity, manage users and their roles, manage API keys, and have complete create, read, update, and delete access to workspaces, AI Agents, flows, environments, items, and reviews.
Partner — broad operational access for the people who build and run automations. Partners can create and manage workspaces, AI Agents, flows, and drafts; publish and run flows; manage environments and variables; work items and submit reviews; manage API keys; and invite and manage users within the limits of their own access. Partners cannot use AI intelligence (InsurGPT) features, which are restricted to Admins, and cannot perform system administration such as configuring enterprise identity or changing organization-level configuration.
Reviewer — a focused role for the people who resolve exceptions. Reviewers can view the files and items they need, work items, submit reviews and field corrections, and approve pending workflow steps. Reviewers cannot build or run flows, manage environments, or administer users and access.
The table below summarizes what each role can do:
| Capability | Admin | Partner | Reviewer |
|---|---|---|---|
| Build and edit AI Agents (flows and drafts) | ✓ | ✓ | — |
| Publish and run flows | ✓ | ✓ | — |
| Use AI intelligence (InsurGPT) features | ✓ | — | — |
| Work items and submit reviews | ✓ | ✓ | ✓ |
| Approve pending workflow steps | ✓ | ✓ | ✓ |
| Manage environments and variables | ✓ | ✓ | — |
| Invite and manage users | ✓ | ✓ | — |
| Assign roles to users | ✓ | ✓ | — |
| Manage API keys | ✓ | ✓ | — |
| Configure enterprise identity (SSO) | ✓ | — | — |
| Manage organization configuration | ✓ | — | — |
Inviting and managing users
Users with the Admin or Partner role can add users to the organization and assign their role and workspace or AI Agent access. A user you add gains access the first time they sign in through your organization's identity provider. Reviewers cannot manage users. When you add a user, assign the least-privileged role that lets them do their job, and grant access only to the workspaces and AI Agents they need.
Workspace and AI Agent access
A user's role defines their capabilities, but access to a specific workspace or AI Agent still has to be granted. Because access is scoped this way, you can keep one team's work separate from another's — for example, giving a reviewer access only to the AI Agent whose items they review, while a builder works in a different AI Agent. See Platform hierarchy for how workspaces and AI Agents are organized.
Authentication and authorization
Bevaya keeps authentication (proving who a user is) separate from authorization (what a user is allowed to do). A user's permissions are determined solely by their assigned role and the tenant they belong to. Signing in confirms identity; the role and access assigned to the user determine everything they can see and do.
Tenant isolation
Your organization is an isolated tenant. A user can only ever see and act within their own organization and within the roles and access granted to them — never across tenant boundaries. This isolation holds for every user regardless of role.
Where to go next
- Platform hierarchy — how organizations, workspaces, and AI Agents organize access.
- Build AI Agents — what users with build access do next.