Users, Roles & Security

User types answer what a person can do in Veezoo. Roles answer the other governance question: what a person can see. These recordings create roles and then use them to restrict Knowledge Graph access, share with user groups, hide columns, filter rows, and tailor the context the AI receives.

Everything runs on one worked scenario, a finance user and a sales user in the same organization, so you can follow how each layer changes what they get back.

Videos

Role Management

Knowledge Graph Restriction & Sharing with User Groups

Column-Level Security

Row-Level Security

Role-Restricted Static Notes

Key points

• Two levers: user types define what someone can do, roles define what they can see.
• Roles live in Veezoo Admin, can double as a user group for sharing, and under Access Control they decide who sees which Knowledge Graph.
• Column-level security: for_user_role on an attribute limits it to those roles, and not_for_user_role does the inverse.
• A restricted attribute does not exist for that user, and because the AI writes VQL rather than raw SQL, no prompt can reveal it.
• Row-level security: a virtual table replaces the class table and matches rows against the logged-in user, with the user context injected during the deterministic SQL translation.
• for_user_role_sql sets the role restriction on a class's entities automatically, so an EMEA user never sees that a Sydney store exists.
• Role-restricted notes: a static_note can be limited to a role, giving those users extra always-on context.

Check your understanding