User Roles in Viven Digital Twin

This page is a reference for organization administrators deciding how to assign roles to their users. Each role controls what a user can see and do inside the Viven Digital Twin platform.

Note: This page covers in-app user roles (RBAC). For AWS IAM roles used during BYOC infrastructure provisioning, see Infrastructure Roles at the bottom.

---

Quick Reference

Role	Best for	Personal Twin	Custom Twins	Admin Console
User	Most employees needing a personal twin	✅	View only	❌
Light User	Broad rollouts of governed custom twins	❌	View only	❌
Data Analyst	Analytics/ops stakeholders	✅	View only	Analytics only
Agent Builder	Users who build and manage custom twins	✅	✅ Create & manage	❌
Setup Admin	IT / platform setup admins	✅	✅ Manage all	Partial
Self-Serve Setup Admin	First admin in a self-serve org	✅	✅ Manage all	Partial
Org Admin	Org-wide operational control	✅	✅ Manage all	Full
Super Admin	Governance, compliance, and audit	✅	✅ Manage all	Full + Audit

---

End-User Roles

User

The default role for employees who should have the full personal Digital Twin experience.

What it unlocks:

• Chat with their own personal/self Digital Twin
• Chat with Digital Twins of colleagues they have access to
• Create a Digital Twin for themselves
• Create Digital Twins for employees they manage (where applicable)
• Use the Agents / Prompt Builder and save personal prompts

Assign to: Any employee you want to give the complete Digital Twin experience — synced documents, personal chat, and self-knowledge management.

---

Light User

A consumption-only tier designed for broad rollouts where the goal is access to one or more curated Custom Twins (e.g., an HR policy bot, onboarding guide, or enablement assistant) without provisioning a personal twin for every user.

What it unlocks:

• Chat with Expert / Custom Twins they've been granted access to
• Get grounded answers from the curated content in those twins

What it does not unlock:

• No personal/self-twin chat
• No document ingestion (documents are not synced for Light Users)
• Cannot create or manage Custom Twins
• No access to Agents / Prompt Builder
• No keyword search against personal documents

Assign to: Users who only need to query a governed Custom Twin (e.g., a company-wide policy bot or training assistant) and don't need a personal twin experience. Ideal for large-scale rollouts where full-user seats are not needed for every employee.

---

Data Analyst

A read-only role scoped exclusively to aggregated usage analytics across the organization.

What it unlocks:

• View org-wide analytics and usage metrics across all Digital Twins (perm_dt_analytics_org_wide)

What it does not unlock:

• No access to raw content, document stores, or individual twin conversations
• No Admin Console management surfaces

Assign to: Analytics, operations, or L&D stakeholders who need visibility into adoption and usage data but should not have access to any personal content or conversations.

---

Builder Roles

Agent Builder

A role for users who need to create and manage Custom / Expert Twins without holding full admin privileges.

What it unlocks:

• Create, edit, and manage Custom/Expert Twins (perm_dt_manage_expert_twins)
• All standard User capabilities (personal twin, Agents, etc.)

Important nuance — org-wide sharing: The ability to share a Custom Twin with the entire organization is controlled by a separate permission (perm_dt_manage_expert_twins_sharing_to_all). An Agent Builder can build a Custom Twin without automatically being able to publish it org-wide. Admins can grant or withhold this sharing permission independently.

Assign to: Power users, knowledge managers, or team leads who are responsible for building and maintaining Custom Twins for their team or organization.

---

Admin Roles

Setup Admin

An IT or platform admin role designed for the people responsible for onboarding, configuring, and maintaining the Digital Twin deployment — without granting them full organizational governance powers.

What it unlocks (Admin Console surfaces):

• Manage employees (add, edit, remove) — perm_dt_manage_employees
• Manage enterprise data sources — perm_dt_manage_data_sources
• Manage privacy settings and restrictions — perm_dt_manage_privacy
• Manage ingestion configurations — perm_dt_manage_ingestion
• Create, edit, publish, or trigger ingestion for any bot — perm_dt_manage_all_bots
• Manage API tokens — perm_dt_manage_api_tokens
• Manage MCP Sources in Admin Console — perm_dt_manage_mcp_sources
• Optionally: Manage Agent/Prompt Gallery org templates — perm_dt_manage_all_agents
• Configure SSO Setup → in the Admin Console
• Configure SMTP Setup → in the Admin Console

What it does not unlock:

• No access to private twin conversations (unless explicitly shared)
• No org-admin governance operations (e.g., cannot add/remove other org admins)
• No audit log access

Assign to: IT administrators, platform engineers, or designated "Digital Twin owners" at the department or org level who are responsible for setting up connectors, managing users, and keeping the system running — but who do not need compliance-level oversight.

---

Self-Serve Setup Admin

A variant of Setup Admin intended for the first administrator in a self-serve organization. This role has the same core setup capabilities as Setup Admin, scoped to what a self-serve admin needs to independently configure and manage their org.

What it unlocks:

• Same core admin surfaces as Setup Admin: manage employees, manage all bots, data sources, privacy, ingestion
• Access to the Employees page and associated management flows (including SCIM token management)
• Self-serve SSO Setup → and SMTP Setup → in the Admin Console

Assign to: The primary administrator in a self-serve org who is responsible for the initial setup and ongoing user management without enterprise IT support.

---

Org Admin

The operational "keys to the kingdom" role for an organization. Org Admins can manage all aspects of the platform and all bots across the org.

What it unlocks:

• All Setup Admin capabilities
• Org-admin operations including managing other org admins (perm_dt_org_admin)
• Org-wide bot management: create, edit, publish, trigger ingestion for any bot (perm_dt_manage_all_bots)
• Org-wide analytics access (perm_dt_analytics_org_wide)
• Manage employees, data sources, privacy, ingestion
• Manage API tokens and MCP Sources
• Configure Branding → in the Admin Console

Assign to: A small number of trusted individuals who are responsible for the overall health and configuration of the Digital Twin platform. This is the primary "platform owner" role.

---

Super Admin

The highest-governance role, focused on compliance, oversight, and audit — rather than day-to-day operational control.

What it unlocks:

• Full Admin Console access
• View audit logs across all Digital Twins
• View org-wide analytics
• Governance and compliance oversight

Assign to: Compliance officers, security leads, or executives who need full visibility and audit access but may not be making day-to-day configuration changes. In most orgs, one or two individuals hold this role.

Org Admin vs. Super Admin: Think of Org Admin as the operational admin (manages bots, users, and configuration) and Super Admin as the governance admin (audit logs, oversight, compliance). The two roles are complementary and can be held by different people.

---

Infrastructure Roles (BYOC Only)

These are AWS IAM roles used during infrastructure provisioning in Bring Your Own Cloud (BYOC) deployments. They are not in-app user roles and should not be assigned to end users.

IAM Role	Purpose
dt-admin-access	Used by Viven engineers to provision the Digital Twin stack; afterward reserved for P0 situations requiring admin access
dt-read-only	Read-only access for monitoring and troubleshooting

---

Permissions Reference

The table below maps each underlying permission to the roles that carry it by default.

Permission	User	Light User	Data Analyst	Agent Builder	Setup Admin	Org Admin	Super Admin
perm_dt_query_self_twin	✅	❌	✅	✅	✅	✅	✅
perm_dt_allow_ingestion	✅	❌	✅	✅	✅	✅	✅
perm_dt_manage_expert_twins	❌	❌	❌	✅	✅	✅	✅
perm_dt_manage_expert_twins_sharing_to_all	❌	❌	❌	Optional	✅	✅	✅
perm_dt_manage_all_bots	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_employees	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_data_sources	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_privacy	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_ingestion	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_api_tokens	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_mcp_sources	❌	❌	❌	❌	✅	✅	✅
perm_dt_manage_all_agents	❌	❌	❌	❌	Optional	✅	✅
perm_dt_analytics_org_wide	❌	❌	✅	❌	❌	✅	✅
perm_dt_org_admin	❌	❌	❌	❌	❌	✅	✅
Audit log access	❌	❌	❌	❌	❌	❌	✅