Role-Based Access Control and Artificial Intelligence Policies

Role-based access control (RBAC) governs access to Policy operations. An authored artificial intelligence (AI) policy governs a different concern: runtime behavior for the selected principals and classifications. Here, runtime means downstream processing of requests or data, not administration of the Policy service. Do not treat these two permission systems as interchangeable.

RBAC in Policy

The platform authenticates users through its supported gateway integration. Policy maps trusted authorities to command capabilities. Editing and rollback also require applicable policy access grants.

The policy_author bundle does not provide review or approval authority. An owner grant does not add either capability. Different authenticated users can therefore perform the author and reviewer responsibilities. This capability separation does not itself enforce mandatory two-person approval.

Refer to roles and permissions for the canonical role and capability tables. Refer to API authentication for the request-level identity contract.

AI Policy in Policy

AI authoring captures classification and principal-specific runtime permissions. Its permissions matrix describes the selected principals’ allowed behavior. It does not assign those principals administrative roles in Policy.

For example, a principal can receive a runtime unprotect permission. Unprotect means allowing supported runtime access to protected content. It does not remove a governed policy. That permission does not allow the principal to submit or approve a Policy draft. Likewise, a Policy approver does not automatically receive runtime unprotect access.

Preview output, saved content, approval, and consumer receipt remain distinct checkpoints. A delivered Federated Guardrails artifact does not prove execution against real traffic. Refer to validation and review decisions and delivery verification.

Verification

Verify product access and authored runtime permissions independently. Refer to authoring procedures for the selected lane. Refer to lifecycle and governance for the review handoff.