This documentation page is live-rendered from the AI WCRM Knowledge Engine.
# Enterprise PBAC & RBAC Permission Assignment Guide
AI WCRM enforces a hybrid **Role-Based Access Control (RBAC)** and **Policy-Based Access Control (PBAC)** framework to ensure strict data segregation, team isolation, and least-privilege security across enterprise organizations.
---
### System Role Hierarchy (RBAC)
AI WCRM includes 5 pre-configured system roles:
| Role | Scope | Key Permissions |
|---|---|---|
| **Organization Owner** | Account-wide | Full system access, billing, team management, API key vault, security policies. |
| **Admin** | Account-wide | User seats, workflow rules, channels, analytics, CRM configuration. |
| **Sales Manager** | Team / Region | Lead assignment, team pipeline view, approval rules, export capabilities. |
| **Sales Agent** | Assigned Leads | View & message assigned contacts, manage own deals, trigger AI calls. |
| **Support Representative** | Inbox Only | Answer shared inbox tickets, tag conversations, use AI auto-replies. |
---
### Policy-Based Access Control (PBAC)
PBAC allows administrators to attach fine-grained condition policies to roles or individual users.
<Callout type="tip">
**Granular PBAC Rules**: Example Policy: *"Sales Agents in North Region can view contacts tagged 'Delhi', but CANNOT export CSV files or view raw API keys."*
</Callout>
#### Configurable PBAC Permission Attributes:
- **`crm.contacts.export`**: Enable/disable CSV export of customer phone numbers.
- **`ai.vault.manage`**: Restrict BYOK API key viewing and editing to Org Owners.
- **`voice.calls.initiate`**: Restrict outbound Voice AI calling by user seat or daily budget.
- **`inbox.mask_phone_numbers`**: Mask customer phone numbers (e.g. +91 9934XXXXXX) for agent seats.
- **`analytics.revenue_view`**: Hide financial revenue figures from front-line support staff.
---
### Configuring PBAC Policies in Admin Dashboard
1. Navigate to **Administration → Roles & Permissions → PBAC Policies**.
2. Click **Create Custom Policy**.
3. Select your target Role or Team Group.
4. Define Allow/Deny policy statements:
```json
{
"Version": "2026-08-01",
"Statement": [
{
"Effect": "Allow",
"Action": [
"crm:contacts:read",
"crm:deals:update",
"voice:call:create"
],
"Resource": "arn:aiwcrm:account:1042:team:sales_north"
},
{
"Effect": "Deny",
"Action": [
"crm:contacts:export",
"ai:vault:read_keys"
],
"Resource": "*"
}
]
}
```
---
<Callout type="warning">
**Audit Logging**: Every permission change, role assignment, or policy override is logged permanently in the SOC-2 immutable audit trail.
</Callout>