Roles and Access

Different people should get different answers. A field agent should see their own customers. A branch manager should see the whole branch. A customer should see only their own policy. Roles make this happen automatically, and the rules are enforced by the platform, never left to the AI.

What a role controls

A role defines three things.

Control	Question it answers	Example
Abilities	Which tools may this person use?	Managers can run the branch report. Field agents cannot.
Records	Which rows may they see?	Only policies assigned to them.
Sensitive details	Which fields are hidden or masked?	Show the last four digits of an ID only.

"Only their own records"

This is called scoping. When a person signs in, the platform knows who they are. Every lookup is automatically limited to their records, for example:

• A field agent sees policies where they are the servicing agent.
• A branch manager sees policies for their branch.
• A customer sees only their own policies.

If someone asks "Show me all agents' policies across the company", the platform refuses. The AI cannot talk its way around it, because the limit is applied before any data comes back.

warning

Scoping depends on reliable identity from your sign-in system. Confirm with IT that each user's identity details, such as agent ID or branch, are passed to Achilles.

Map your job titles to roles

Your CRM or portal probably has its own titles, such as Associate, Manager or Super Admin. Role mapping translates them into the agent's roles. You do this once.

Your job title	Agent role
Agent, Associate	Field agent
Manager	Branch manager
Super Admin	Administrator

A second organisation with different titles only needs a different mapping.

The safe fallback

If someone signs in with a title you have not mapped, they do not get full access. They get the least-privileged role, which is the one with the fewest abilities. Nothing breaks, and nobody sees more than they should. You can then add the missing mapping.

tip

Review the fallback role when you set up. If it can do more than a brand-new employee should, tighten it.

How to set up roles

1. Open your agent in the console and go to its roles settings.
2. List the types of users, for example field agent, branch manager, customer service, administrator.
3. For each, choose which abilities they can use. See Agent abilities.
4. Choose how their records are limited, such as by agent, by branch or by customer.
5. Add your job-title mapping.
6. Test in Playground as each role. See Test your agent.

Agent Builder proposes roles from your SOP, so you often only need to review them. See Agent Builder.

Roles for people using the console

Roles also apply to your own team members in the console. That is a separate setting. See Users and teams.

Good practice

• Start narrow and widen access when needed.
• Test one question per role, and confirm the refusals too.
• Review roles when your organisation changes.
• Keep a record of who approved each role. See Audit trail.

Related: Personal data and Safety overview.