Roles and permissions
The four governance roles, what each can do, and why your profile role grants nothing.
WhoEveryoneView as Markdown
Access in AMC comes from governance roles. There are four, in rank order. A user with no governance role shows as None.
| Role | Scope |
|---|---|
| Super Admin | The whole installation. Also the only role that can request in-app updates and revoke Super Admin or Tenant Admin. |
| Tenant Admin | Everything in one organization: users, departments, email, sign-in, triggers, and all departments' work. |
| Department Manager | The departments they manage: runs, interventions, budgets, overrides, golden runs, and department audit. |
| Agent Manager | The agents they manage: register and run them, with read access to those agents' departments. |
What each role can do
| Action | Tenant Admin | Department Manager | Agent Manager |
|---|---|---|---|
| Start or cancel a run | Yes | Yes | Yes |
| Register, edit, deactivate agents | Yes | Yes | Yes |
| Reassign an agent's owner | Yes | Yes | No |
| Reply to an intervention | Yes | Yes | No |
| Promote or retire a golden run | Yes | Yes | No |
| Mark a run Failed or Complete | Both ways | Complete to Failed only | No |
| Edit budgets, submit overrides | Yes | Yes | No |
| Open the Governance tab | Yes | Yes | No |
| Manage users, departments, email, sign-in, triggers | Yes | No | No |
Super Admin can do everything in the table. Department Managers act only inside their own departments. Approving a budget override also depends on the approval tier; see Manage department budgets and overrides.
Departments decide what you see
Runs, interventions, ROI, and budgets are scoped to the departments you can access. If you have no department, you see only workflows that aren't assigned to one. Use the Department filter in the top bar to narrow every page to one department.
Related articles
Last updated 2026-10-21