> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions & Access Control

> Understanding how permissions and access control work in Alex

## Overview

Alex uses a flexible **Policy-Based Access Control** system that allows fine-grained control over what users can do within the platform.

Each user is assigned a **role** that contains a set of **policies**. These policies define which **resources** a user can access and what **actions** they can perform.

## Core Concepts

### Actions

Actions define what operations a user can perform on a resource:

| Action | Description                              |
| ------ | ---------------------------------------- |
| Create | Create new records                       |
| Read   | View/read records                        |
| Update | Modify existing records                  |
| Delete | Remove records                           |
| Manage | Full access (includes all actions above) |

## Available Resources

Resources represent the entities and features that can be controlled through policies.

| Resource        | Available Actions          | Description                             |
| --------------- | -------------------------- | --------------------------------------- |
| Dashboard       | Access                     | Access to the dashboard page            |
| Jobs            | Read, Edit, Create, Delete | Job records and their configuration     |
| Sessions        | Read, Edit, Delete         | Interview session records               |
| Candidates      | Read                       | Candidate records                       |
| Workflows       | Read, Edit, Create         | Automation workflows                    |
| Global Settings | Manage                     | Company-wide settings and configuration |

### Jobs: Additional Permissions

When configuring **Jobs** permissions, you can also control access to:

| Permission           | Description                           |
| -------------------- | ------------------------------------- |
| Can access settings  | Access to job configuration settings  |
| Can access kit       | Access to interview guide management  |
| Can access analytics | Access to job analytics and reporting |

## System Roles

Alex includes built-in system roles that provide common permission configurations.

| Role           | Description                                                   |
| -------------- | ------------------------------------------------------------- |
| Admin          | Full access to all resources, including Global Settings       |
| Recruiter      | Full access to day-to-day operations, without Global Settings |
| Hiring Manager | Limited access to view sessions and jobs shared with them     |

### Admin

Full administrative access to the company account, including all resources and Global Settings.

### Recruiter

Full access to day-to-day operations, without Global Settings:

* **Dashboard**: Full access
* **Jobs**: Full access (including settings, kit, and analytics)
* **Sessions**: Full access
* **Candidates**: Full access
* **Workflows**: Read
* **Templates**: Full access
* **Labels**: Full access

### Hiring Manager

Limited access for evaluators who review shared candidates:

* **Jobs**: Read only for jobs with sessions shared to them
* **Sessions**: Read only for sessions shared to them

Hiring managers have restricted decision options. They can only set candidate decisions to:

* **Shortlisted**
* **Rejected**
* **No decision**

They cannot set final decisions like Placed, Hired, or Submitted.

## Custom Roles

In addition to system roles, you can create custom roles with specific permissions tailored to your organization's needs. Custom roles give you full control over which resources and actions are available to users.

## Conditional Policies

For **Jobs**, you can add conditions to restrict which specific jobs a user can access.

| Condition  | Description                                                                   |
| ---------- | ----------------------------------------------------------------------------- |
| Label      | Filter access by job labels (e.g., "Engineering", "Sales")                    |
| Created by | Restrict to jobs created by specific users, or "self" for the user's own jobs |
| Workflow   | Filter by assigned workflow                                                   |

Conditions can be combined. For example, a user might only be able to edit their own jobs that also have specific labels.

## How Permissions are Evaluated

1. **Admin Check**: Users with full "manage all" access receive admin privileges.

2. **Policy Evaluation**: For other users, each policy is evaluated:
   * Allow policies grant access
   * Deny policies explicitly block access (useful for exceptions)

3. **Default Deny**: If no policy explicitly allows an action, it is denied by default.

## Managing Roles

Roles can be managed through the Alex dashboard under **Settings > Team > Roles**. Each role contains:

* **Name**: A descriptive name for the role
* **Policies**: The set of policies that define what users with this role can do

When you assign a role to a user, they inherit all the policies defined in that role.

## Best Practices

<CardGroup cols={2}>
  <Card title="Principle of Least Privilege" icon="shield-check">
    Grant users only the permissions they need to perform their job functions.
  </Card>

  <Card title="Use Deny Sparingly" icon="ban">
    Prefer granting specific permissions rather than allowing everything and denying exceptions.
  </Card>

  <Card title="Review Before Assigning" icon="eye">
    Verify a role has the intended access before assigning it to team members.
  </Card>

  <Card title="Audit Regularly" icon="clipboard-list">
    Review role assignments periodically to ensure they align with current responsibilities.
  </Card>
</CardGroup>