> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria.
> Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types.
> Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai.
> Do not invent a public hostname for private orchestrators or env API internals.
> Do not confuse control-plane latches with Environments confirmation latches.
> Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY.
> Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports.

# Role-Based Access Control

> Control who can access what within your Akhara organization with granular, role-based permissions.

## Overview

Akhara uses Role-Based Access Control (RBAC) to manage permissions across your organization. Roles define what actions users can perform, while assignments determine which resources they can access.

<Callout type="info" title="Healthcare-First Design">
  Akhara's RBAC is designed for healthcare workflows. Clinical reviewers have different permissions than engineers, and PHI access is strictly controlled and audited.
</Callout>

## Built-in Roles

Akhara provides predefined roles optimized for healthcare AI evaluation workflows:

### Organization Roles

| Role        | Description                                    | Typical Users              |
| ----------- | ---------------------------------------------- | -------------------------- |
| **Owner**   | Full administrative access to the organization | Founders, CTO              |
| **Admin**   | Manage users, billing, and org settings        | Engineering managers, IT   |
| **Member**  | Access to assigned projects only               | Engineers, data scientists |
| **Billing** | View and manage billing only                   | Finance team               |

### Project Roles

| Role              | Description                          | Key Permissions                          |
| ----------------- | ------------------------------------ | ---------------------------------------- |
| **Project Admin** | Full control over a specific project | Manage evaluators, reviewers, settings   |
| **Developer**     | Build and run evaluations            | Create datasets, run evals, view results |
| **Reviewer**      | Grade AI outputs in review queue     | Access review UI, submit grades          |
| **Viewer**        | Read-only access to results          | View dashboards, export reports          |

### Clinical Reviewer Roles

For human-in-the-loop review, Akhara enforces credential-based access:

| Role                   | Required Credentials   | Can Review                                     |
| ---------------------- | ---------------------- | ---------------------------------------------- |
| **Physician Reviewer** | Active MD/DO license   | All clinical decisions, triage, diagnoses      |
| **NP Reviewer**        | Active NP license      | Triage, symptom assessment, care plans         |
| **RN Reviewer**        | Active RN license      | Protocol compliance, documentation quality     |
| **Quality Analyst**    | Internal certification | Non-clinical metrics, formatting, completeness |

<Callout type="warning" title="Credential Verification">
  Clinical reviewer roles require credential verification before activation. Akhara validates medical licenses against state board databases.
</Callout>

## Permission Matrix

### Dataset Permissions

| Action         | Owner | Admin | Developer | Reviewer | Viewer |
| -------------- | ----- | ----- | --------- | -------- | ------ |
| Create dataset | ✓     | ✓     | ✓         | -        | -      |
| Upload samples | ✓     | ✓     | ✓         | -        | -      |
| View samples   | ✓     | ✓     | ✓         | ✓        | ✓      |
| Delete dataset | ✓     | ✓     | -         | -        | -      |
| Export dataset | ✓     | ✓     | ✓         | -        | ✓      |

### Evaluation Permissions

| Action               | Owner | Admin | Developer | Reviewer | Viewer |
| -------------------- | ----- | ----- | --------- | -------- | ------ |
| Create evaluation    | ✓     | ✓     | ✓         | -        | -      |
| Run evaluation       | ✓     | ✓     | ✓         | -        | -      |
| View results         | ✓     | ✓     | ✓         | ✓        | ✓      |
| Configure evaluators | ✓     | ✓     | ✓         | -        | -      |
| Cancel evaluation    | ✓     | ✓     | ✓         | -        | -      |

### Review Permissions

| Action              | Owner | Admin | Developer | Reviewer | Viewer |
| ------------------- | ----- | ----- | --------- | -------- | ------ |
| Access review queue | ✓     | ✓     | -         | ✓        | -      |
| Submit grades       | ✓     | ✓     | -         | ✓        | -      |
| Override AI scores  | ✓     | ✓     | -         | ✓\*      | -      |
| View review history | ✓     | ✓     | ✓         | ✓        | ✓      |
| Export reviews      | ✓     | ✓     | ✓         | -        | ✓      |

\*Reviewers can only override within their credentialed scope

### PHI Access

| Action                    | Owner | Admin | Developer | Reviewer | Viewer |
| ------------------------- | ----- | ----- | --------- | -------- | ------ |
| View PHI fields           | ✓\*   | ✓\*   | -         | ✓\*      | -      |
| Export PHI                | ✓\*   | -     | -         | -        | -      |
| Access de-identified data | ✓     | ✓     | ✓         | ✓        | ✓      |

\*Requires explicit PHI access grant and is fully audited

## Managing Roles

### Assign a Role via SDK

```python theme={null}
from akhara import Akhara

client = Akhara()

# Add user to organization
client.users.invite(
    email="dr.smith@hospital.org",
    org_role="member"
)

# Assign project role
client.projects.add_member(
    project="proj_triage_v2",
    user="user_abc123",
    role="reviewer",
    reviewer_type="physician"  # Requires credential verification
)
```

### Assign a Role via Dashboard

<Steps>
  <Step title="Navigate to Settings">
    Go to **Organization Settings** → **Members**
  </Step>

  <Step title="Invite or Select User">
    Click **Invite Member** or select an existing user
  </Step>

  <Step title="Assign Roles">
    Select organization role and project-specific roles
  </Step>

  <Step title="Configure PHI Access">
    If needed, enable PHI access (requires justification)
  </Step>
</Steps>

## Custom Roles

Enterprise plans can define custom roles with granular permissions:

```python theme={null}
# Create custom role
client.roles.create(
    name="senior_reviewer",
    description="Senior clinical reviewer with training permissions",
    permissions=[
        "reviews:read",
        "reviews:write",
        "reviews:override",
        "reviewers:train",      # Can train junior reviewers
        "datasets:read",
        "evaluations:read"
    ],
    requires_credentials=["MD", "DO", "NP"]
)

# Assign custom role
client.projects.add_member(
    project="proj_abc",
    user="user_xyz",
    role="senior_reviewer"
)
```

## Best Practices

<CardGroup cols={2}>
  <Card title="Principle of Least Privilege" icon="lock">
    Grant only the minimum permissions needed for each role
  </Card>

  <Card title="Separate Clinical Access" icon="user-md">
    Use credential-verified roles for any clinical decision review
  </Card>

  <Card title="Regular Audits" icon="clipboard-check">
    Review role assignments quarterly and after personnel changes
  </Card>

  <Card title="PHI Minimization" icon="shield">
    Limit PHI access to roles that absolutely require it
  </Card>
</CardGroup>

## Related

<CardGroup cols={2}>
  <Card title="Audit Logs" icon="scroll" href="/evaluation/api-reference/authentication/audit-logs">
    Track all permission changes and access events
  </Card>

  <Card title="Org & Project Permissions" icon="sitemap" href="/evaluation/api-reference/authentication/org-project-permissions">
    Configure organization and project-level access
  </Card>
</CardGroup>