Roles and permissions in Unstructured and Complex Documents projects

IXP roles and permissions in Unstructured and Complex Documents projects, mapping project actions such as annotating documents and publishing models to the permissions that grant them.

Access to Unstructured and Complex Documents projects is managed through IXP roles, in the Manage Access tab of the Administration page. Each role grants a predefined set of permissions, so you cannot assign individual permissions. For the full list of roles, the permissions they include, and how to assign them, refer to Managing access.

Each Unstructured and Complex Documents project stores its documents, taxonomy, and training data in internal resources, such as sources and a dataset, which you do not manage directly. The permissions granted on these internal resources determine the actions you can perform in the project.

The role and permission descriptions on the Managing access page use generic terms that apply across IXP project types. The following table shows what these terms mean specifically in Unstructured and Complex Documents projects:

Generic terms used across IXP	Meaning in Unstructured and Complex Documents projects
Comments	Documents.
Sources	Internal containers that store the documents of a project.
Dataset	The taxonomy and training data of a project.
Review and label data	Annotate and validate documents.

Permissions for project actions

The following table maps the actions you can perform in an Unstructured and Complex Documents project to the permissions that grant them:

Action	Required permission
View documents and their predictions.	Source - Read and Dataset - Read
View user properties marked as sensitive without redaction.	Source - ReadSensitive
Upload and delete design-time documents.	Comment - Manage
Create, edit, and delete taxonomy elements, including field groups and fields, and annotate documents.	Dataset - Review
Import and export taxonomies.	Dataset - Write
Publish and unpublish model versions and update their tags.	Model - Manage
Export a project through the command-line interface.	Dataset - Export, together with Dataset - Read and Source - Read
Read and upload documents, and consume runtime predictions, including discovering projects in Studio.	Project - Execute, when runtime permission checks are enabled
View, create, modify, and delete packages, which contain the model versions deployed to Orchestrator folders.	Packages - Read, Packages - Write, Packages - Delete
Create and delete projects and their runtime deployments, and manage quotas.	Tenant - Manage

You do not need Dataset - Export to download documents from the project interface.

Note:

Deploying a package to an Orchestrator folder, or deleting a deployment from it, additionally requires the corresponding IXP Models permissions in Orchestrator.

What each role grants in a project

Role	Actions granted
IXP Viewer	View documents and their predictions.
IXP Model Trainer	View documents, annotate them, manage the taxonomy, including importing and exporting it, and publish and unpublish model versions.
IXP Developer	View documents, upload and delete documents, publish and unpublish model versions, export the project through the command-line interface, and consume runtime predictions.
IXP Automation User	Upload documents and consume runtime predictions, for example from agents or automations.
IXP Project Admin	Manage everything within the project, including role assignments and exporting the project. You cannot create or delete projects.
IXP Package Admin, IXP Package Publisher, IXP Package Reader (preview)	Create, modify, delete, or view packages in the tenant, depending on the role.
IXP Service Admin	Create and delete projects, and manage quotas at tenant level. This role grants no permissions within projects, unless you also assign a project role.

Note:

Permissions that gate Communications Mining features, such as streams, buckets, integrations, dashboards, and alerts, have no user-facing function in Unstructured and Complex Documents projects.