Users & Roles

Role-based access control (RBAC) with fine-grained permissions for user management, workflow editing, and system administration.

Overview

M3 Forge uses a role-based permission model to control who can perform which actions. Each user is assigned one or more roles within a workspace, and roles define specific permissions across the platform.

Built-In Roles

M3 Forge provides six predefined system roles. These roles cannot be modified or deleted.

Administrator

Capabilities:

• All permissions across every resource (wildcard *)
• User management (invite, remove, change roles, impersonate)
• System settings, API keys, credentials, role management

Use case: Primary workspace administrator with full control.

Editor

Capabilities:

• Create, edit, delete, and execute workflows
• Manage DAGs, query plans, and credentials
• Create and manage API keys
• Create and update RAG indexes
• Read gateways, deployments, events, annotator configs, and roles

Use case: Day-to-day contributors building and iterating on AI pipelines.

Member

Capabilities:

• View all resources (workflows, DAGs, jobs, deployments, storage, etc.)
• List credentials (without reading values)

Restrictions:

• Cannot create, modify, or execute any resource

Use case: Stakeholders, managers, and auditors who need visibility but not operational access. This is the default role for new users.

Workflow Editor

Capabilities:

• Full workflow and DAG management (create, edit, delete, execute)
• Full query plan management
• Manage jobs (read, cancel, retry)
• Read gateways and test connectivity

Restrictions:

• No credential access
• No deployment management
• No system settings

Use case: Pipeline developers who build workflows without needing credential or infrastructure access.

Deployment Editor

Capabilities:

• Full deployment management (create, edit, delete)
• Full gateway management (create, edit, delete, test)
• Read workflows, jobs, and roles

Restrictions:

• No workflow editing or execution
• No credential access
• No system settings

Use case: Release engineers who manage infrastructure without modifying pipeline logic.

Document Editor

Capabilities:

• Full RAG index management (create, edit, delete)
• Full annotator config management
• Read and update storage
• Read workflows and roles

Restrictions:

• No workflow editing or execution
• No credential or deployment access

Use case: Knowledge base curators who manage document indexes and annotation configurations.

Managing Users

Inviting Users

Accepting Invitations

When a user receives an invitation:

1. Click the link in the email
2. Sign in or create an account
3. Accept the invitation to join the workspace

They immediately gain access with the assigned role.

Changing User Roles

To update a user’s role:

Removing Users

To remove a user from the workspace:

1. Click Remove next to the user’s name
2. Confirm removal
3. User loses access to this workspace immediately

Removing a user:

• Does not delete their account
• Does not affect their access to other workspaces
• Does not delete resources they created (workflows, prompts remain)

Suspending Users

Temporarily disable a user’s access:

1. Click user in the list
2. Select Suspend
3. User cannot log in until unsuspended

Useful for:

• Employees on leave
• Contractors whose engagement ended
• Security incidents pending investigation

Custom Roles

For advanced permission requirements, create custom roles with specific permission combinations.

Creating a Custom Role

Example Custom Roles

Prompt Engineer:

Permissions:
- prompts.view, prompts.create, prompts.edit, prompts.test, prompts.delete
- workflows.view, workflows.execute
- monitoring.view

Use case: Team member focused on prompt development and testing

QA Tester:

Permissions:
- workflows.view, workflows.execute
- prompts.view
- agents.view
- monitoring.view, monitoring.export

Use case: Quality assurance testing workflows and documenting results

Pipeline Operator:

Permissions:
- workflows.view, workflows.execute
- monitoring.view

Use case: Operations team running production workflows without edit access

Role Assignment Best Practices

Principle of Least Privilege

Start users with minimal permissions and grant additional access as needed:

1. New user joins → assigned Member role (read-only, default)
2. User needs focused access → assign a specialized editor role (Workflow, Deployment, or Document Editor)
3. User needs broad contributor access → upgrade to Editor
4. User needs full system control → upgrade to Administrator

Avoid granting Administrator roles by default.

Specialized Roles for Separation of Duties

Use the specialized editor roles to enforce boundaries:

• Workflow Editor — Pipeline developers who don’t need credential access
• Deployment Editor — Release engineers managing infrastructure
• Document Editor — Knowledge base curators managing RAG indexes

Time-Limited Role Escalation

For temporary elevated access:

1. Grant Administrator role to user
2. Set calendar reminder to downgrade after task completes
3. Downgrade to original role

Useful for onboarding new admins or temporary support access.

Role Ownership

Assign role management responsibility:

• Administrator — 1-2 platform operators
• Editor — Active contributors
• Workflow / Deployment / Document Editor — Domain specialists
• Member — Stakeholders and auditors

Single Sign-On (SSO)

M3 Forge supports SSO for centralized user authentication.

OAuth Providers

Connect with popular identity providers:

• Google Workspace — Authenticate with Google accounts
• GitHub — Authenticate with GitHub accounts
• Microsoft Entra ID — Authenticate with Microsoft accounts

SAML Integration

For enterprise identity providers (Okta, OneLogin, Azure AD):

Audit Logging

All user actions are logged for security and compliance.

Logged Events

• User login/logout — Timestamps and IP addresses
• Role changes — Who changed whose role to what
• Resource creation/modification/deletion — Workflows, prompts, agents
• Settings changes — LLM connections, API keys
• Failed authentication attempts — Potential security issues

Viewing Audit Logs

Navigate to Settings → Audit Logs to view activity:

Exporting Audit Logs

For compliance requirements, export logs as CSV or JSON:

1. Apply filters (date range, user, action type)
2. Click Export
3. Choose format (CSV, JSON, PDF)
4. Download file

Troubleshooting

User Cannot Modify Resources

Cause: User has Member role which is read-only.

Solution: Upgrade to the appropriate editor role (Editor, Workflow Editor, Deployment Editor, or Document Editor) depending on what they need to modify.

User Cannot Configure LLM Connections

Cause: Only Administrators have settings permissions.

Solution: Upgrade to Administrator role or have an Administrator configure connections.

Cannot Remove Last Administrator

Cause: Attempting to remove the only Administrator in workspace.

Solution: Assign Administrator role to another user first, then remove or downgrade the original.

SSO Login Failing

Cause: Misconfigured OAuth or SAML settings.

Solution: Verify client ID/secret and redirect URIs match provider configuration. Check audit logs for specific error messages.

Too Many Failed Login Attempts

Cause: Account locked due to repeated failed authentications.

Solution: Wait 15 minutes for automatic unlock, or contact workspace owner to manually unlock account.

Next Steps

• View the full RBAC permissions matrix for detailed scope breakdowns
• Configure workspaces for multi-tenant isolation
• Set up LLM connections for your team
• Generate API keys with appropriate scopes